CVE-2026-116367: DeepSeek Harness sandbox.ts createContext
A vulnerability was found in DeepSeek Harness up to 0.1.0-rc.5. This vulnerability affects the function createContext of the file packages/extensions/cordis-host-runner/src/sandbox.ts. The manipulation results in sandbox issue. It is possible to launch the attack remotely. The vendor was contacted early about this disclosure but did not respond in any way.
Affected Software
Event History
Frequently Asked Questions
Which versions are known to be affected?
DeepSeek Harness versions up to and including 0.1.0-rc.5 are reported as affected.
Can this be exploited remotely without prior access?
The vulnerability is reported as remotely exploitable and the vector is network-based. The available information does not identify any required privileges, but the supplied CVSS vector indicates none are required; user interaction is required.
What security impact is reported?
The supplied severity data rates the issue as medium with a CVSS score of 6.3. It reports low impact to confidentiality, integrity, and availability.
Is a vendor fix or response available?
The disclosure states that the vendor was contacted early but did not respond. No patch, workaround, or mitigation is provided in the available information.