{"id":"CVE-2026-116367","title":"DeepSeek Harness sandbox.ts createContext","summary":"A vulnerability was found in DeepSeek Harness up to 0.1.0-rc.5. This vulnerability affects the function createContext of the file packages/extensions/cordis-host-runner/src/sandbox.ts. The manipulation results in sandbox issue. It is pos…","severity":"medium","cvss":6.3,"cvssVector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:L/E:X/RL:X/RC:C","cvssSource":"cna","cwe":["CWE-265","CWE-264"],"vendor":"DeepSeek","product":"Harness","affected":["Harness 0.1.0-rc.0","Harness 0.1.0-rc.1","Harness 0.1.0-rc.2","Harness 0.1.0-rc.3","Harness 0.1.0-rc.4","Harness 0.1.0-rc.5"],"published":"2026-10-26","updated":"2026-10-26","sourceUpdated":"2026-10-26T15:30:15.468Z","source":"CVEORG","sourceUrl":"https://www.cve.org/CVERecord?id=CVE-2026-116367","references":[{"url":"https://vuldb.com/vuln/426331","label":"VDB-426331 | DeepSeek Harness sandbox.ts createContext"},{"url":"https://vuldb.com/vuln/426331/cti","label":"VDB-426331 | CTI Indicators (IOB, IOC, TTP, IOA)"},{"url":"https://vuldb.com/cve/CVE-2026-116367","label":"CVE-2026-116367 | CVE Analysis and Report"},{"url":"https://vuldb.com/submit/1012736","label":"Submit #1012736 | DeepSeek deepseek-harness（@deepseek-ai/dsh，DeepSeek Harness） 0.2.0-rc.2 Remote Code Execution"}],"tags":["cve.org"],"ingestedAt":"2026-10-26T16:31:40.071Z","slug":"CVE-2026-116367","body":"## Overview\n\nA vulnerability was found in DeepSeek Harness up to 0.1.0-rc.5. This vulnerability affects the function createContext of the file packages/extensions/cordis-host-runner/src/sandbox.ts. The manipulation results in sandbox issue. It is possible to launch the attack remotely. The vendor was contacted early about this disclosure but did not respond in any way.\n\n## Affected\n\n- `Harness 0.1.0-rc.0`\n- `Harness 0.1.0-rc.1`\n- `Harness 0.1.0-rc.2`\n- `Harness 0.1.0-rc.3`\n- `Harness 0.1.0-rc.4`\n- `Harness 0.1.0-rc.5`\n\n## Remediation\n\nRefer to the linked advisories for vendor-supplied fixes and affected version ranges.","depth":"sunlit","depthScore":35,"depthScoreParts":{"impact":34.7,"likelihood":0,"exploitation":0,"ransomware":0},"changes":[]}