CVE-2026-109375: Vercel deepsec before 1.1.17 Arbitrary File Write via Symlink in Sandbox Tarball Extraction
Vercel deepsec from 0.1.0 before 1.1.17 contains a link following vulnerability in extractTarballLocally that allows sandboxed code to write files outside the sandbox by planting links in result tarballs. Attackers controlling sandbox code, such as a prompt-injected coding agent, can plant symbolic or hard links in the host data directory to write arbitrary files on the orchestrator host.
Affected Software
Event History
Frequently Asked Questions
Who is exposed to this issue?
Deployments using Vercel deepsec versions from 0.1.0 through versions before 1.1.17 are affected when untrusted or attacker-controlled code can execute in a sandbox and produce result tarballs. A prompt-injected coding agent is an example of a source that could control sandboxed code.
What does an attacker need to exploit it?
The attacker needs control of code running in the sandbox and must be able to plant symbolic or hard links in result tarballs. Exploitation relies on the orchestrator extracting those tarballs locally through the vulnerable extraction path.
What is the impact on the host?
A successful attack can cause writes outside the sandbox, including arbitrary file writes on the orchestrator host. The affected weakness follows links placed in the host data directory during tarball extraction.
What should be done if immediate patching is not possible?
Do not allow untrusted or potentially prompt-injected code to run in affected sandboxes that can generate result tarballs. Restrict access to the host data directory and avoid locally extracting untrusted sandbox result tarballs until an updated version is deployed.