CVE-2026-116367
Received Received - Intake

DeepSeek Harness Sandbox Escape Vulnerability

Publication date: 2026-10-26

Last updated on: 2026-10-26

Assigner: VulDB

Description
A vulnerability was found in DeepSeek Harness up to 0.1.0-rc.5. This vulnerability affects the function createContext of the file packages/extensions/cordis-host-runner/src/sandbox.ts. The manipulation results in sandbox issue. It is possible to launch the attack remotely. The vendor was contacted early about this disclosure but did not respond in any way.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-10-26
Last Modified
2026-10-26
Generated
2026-10-26
AI Q&A
2026-10-26
EPSS Evaluated
N/A
NVD
CVE-2026-116367
EUVD
EUVD-2026-109917

Affected Vendors & Products

Showing 6 associated CPEs
Vendor Product Version / Range
DeepSeek Harness 0.1.0-rc.0
DeepSeek Harness 0.1.0-rc.1
DeepSeek Harness 0.1.0-rc.2
DeepSeek Harness 0.1.0-rc.3
DeepSeek Harness 0.1.0-rc.4
DeepSeek Harness 0.1.0-rc.5

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-265
CWE-264 Permissions, Privileges, and Access Controls

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This vulnerability is in DeepSeek Harness up to version 0.1.0-rc.5, specifically in the createContext function of the sandbox.ts file. It allows remote attackers to bypass sandbox restrictions, potentially executing unauthorized code or actions.

Impact Analysis

If exploited, this vulnerability could allow remote attackers to escape the sandbox environment, leading to unauthorized code execution, data breaches, or system compromise. Users of affected versions should update immediately.

Mitigation Strategies

Immediately update DeepSeek Harness to the latest version beyond 0.1.0-rc.5. If no update is available, consider disabling the affected function createContext in packages/extensions/cordis-host-runner/src/sandbox.ts or isolating the system from untrusted networks.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-116367. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart