CVE-2026-116367: DeepSeek Harness sandbox.ts createContext

Severity: medium (CVSS 6.3 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 0.3% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2026-10-26 · updated 2026-10-26
Weakness: CWE-264

Description

A vulnerability was found in DeepSeek Harness up to 0.1.0-rc.5. This vulnerability affects the function createContext of the file packages/extensions/cordis-host-runner/src/sandbox.ts. The manipulation results in sandbox issue. It is possible to launch the attack remotely. The vendor was contacted early about this disclosure but did not respond in any way.

Affected products

DeepSeek Harness: 0.1.0-rc.0, 0.1.0-rc.1, 0.1.0-rc.2, 0.1.0-rc.3, 0.1.0-rc.4, 0.1.0-rc.5

References

https://vuldb.com/cve/CVE-2026-116367
https://vuldb.com/submit/1012736
https://vuldb.com/vuln/426331
https://vuldb.com/vuln/426331/cti

Get alerted when CVE-2026-116367 or the next vulnerability affects your stack