CVE-2026-108788
Received Received - Intake

Sandbox Escape in DeepSeek Harness via Profile Manipulation

Publication date: 2026-10-12

Last updated on: 2026-10-12

Assigner: VulDB

Description
A vulnerability was determined in deepseek-ai deepseek-harness up to 0.1.1-rc.2. The impacted element is the function spawn of the component Sandbox. Executing a manipulation of the argument Profile can lead to sandbox issue. It is possible to launch the attack on the local host. The exploit has been publicly disclosed and may be utilized. The vendor was contacted early about this disclosure but did not respond in any way.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-10-12
Last Modified
2026-10-12
Generated
2026-10-12
AI Q&A
2026-10-12
EPSS Evaluated
N/A
NVD
CVE-2026-108788
EUVD
EUVD-2026-97146

Affected Vendors & Products

Showing 3 associated CPEs
Vendor Product Version / Range
deepseek-ai deepseek-harness 0.1.1-rc.0
deepseek-ai deepseek-harness 0.1.1-rc.1
deepseek-ai deepseek-harness 0.1.1-rc.2

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-265
CWE-264 Permissions, Privileges, and Access Controls

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This vulnerability exists in deepseek-ai deepseek-harness versions up to 0.1.1-rc.2. It involves the function spawn in the Sandbox component where manipulating the Profile argument can lead to sandbox issues. The attack can be executed locally and has been publicly disclosed.

Detection Guidance

The provided CVE data does not include specific detection methods or commands for identifying this vulnerability on a network or system. The vulnerability involves the 'spawn' function in the 'Sandbox' component of deepseek-harness up to version 0.1.1-rc.2, where manipulation of the 'Profile' argument could lead to sandbox issues.

Impact Analysis

The vulnerability allows an attacker to manipulate the sandbox environment by altering the Profile argument in the spawn function. This could lead to unauthorized access or execution of malicious code on the local system, potentially compromising data integrity or system security.

Compliance Impact

The vulnerability in deepseek-harness allows sandbox bypass via manipulated Profile arguments, which could lead to unauthorized local access. This may impact compliance by enabling data exfiltration or unauthorized system access, potentially violating GDPR (data protection) or HIPAA (health data security) if sensitive data is involved.

Mitigation Strategies

Update deepseek-harness to a version beyond 0.1.1-rc.2 if available. If not, consider disabling the Sandbox component or restricting access to the Profile argument in the spawn function. Monitor for unusual local host activity.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-108788. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart