What’s Vulnerable › Vulnerabilities

CVE-2026-101102: deepseek-ai deepseek-harness Code Mode Sandbox run_code sandbox

• Severity: medium (CVSS 6.3 v3.1)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 0.2% probability of exploitation in the next 30 days
• Public exploit or detection template: none known
• Published: 2026-09-28 · updated 2026-10-01
• Weakness: CWE-264

Description

A vulnerability was found in deepseek-ai deepseek-harness up to 0.1.0-rc.7. Impacted is the function run_code of the component Code Mode Sandbox. The manipulation results in sandbox issue. The attack can be executed remotely. The vendor's own code, SAFETY.md, and design notes all explicitly state the worker is "containment, not a security boundary". The vendor was contacted early about this disclosure but did not respond in any way.

Affected products

• deepseek-ai deepseek-harness: 0.1.0-rc.0, 0.1.0-rc.1, 0.1.0-rc.2, 0.1.0-rc.3, 0.1.0-rc.4, 0.1.0-rc.5 (+2)

References

• https://vuldb.com/cve/CVE-2026-101102
• https://vuldb.com/submit/935737
• https://vuldb.com/submit/937812
• https://vuldb.com/vuln/410977
• https://vuldb.com/vuln/410977/cti

Get alerted when CVE-2026-101102 or the next vulnerability affects your stack