---
id: CVE-2026-116367
title: DeepSeek Harness sandbox.ts createContext
summary: >-
  A vulnerability was found in DeepSeek Harness up to 0.1.0-rc.5. This
  vulnerability affects the function createContext of the file
  packages/extensions/cordis-host-runner/src/sandbox.ts. The manipulation
  results in sandbox issue. It is pos…
severity: medium
cvss: 6.3
cvssVector: 'CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:L/E:X/RL:X/RC:C'
cvssSource: cna
cwe:
  - CWE-265
  - CWE-264
vendor: DeepSeek
product: Harness
affected:
  - Harness 0.1.0-rc.0
  - Harness 0.1.0-rc.1
  - Harness 0.1.0-rc.2
  - Harness 0.1.0-rc.3
  - Harness 0.1.0-rc.4
  - Harness 0.1.0-rc.5
published: '2026-10-26'
updated: '2026-10-26'
sourceUpdated: '2026-10-26T15:30:15.468Z'
source: CVEORG
sourceUrl: 'https://www.cve.org/CVERecord?id=CVE-2026-116367'
references:
  - url: 'https://vuldb.com/vuln/426331'
    label: VDB-426331 | DeepSeek Harness sandbox.ts createContext
  - url: 'https://vuldb.com/vuln/426331/cti'
    label: 'VDB-426331 | CTI Indicators (IOB, IOC, TTP, IOA)'
  - url: 'https://vuldb.com/cve/CVE-2026-116367'
    label: CVE-2026-116367 | CVE Analysis and Report
  - url: 'https://vuldb.com/submit/1012736'
    label: >-
      Submit #1012736 | DeepSeek deepseek-harness（@deepseek-ai/dsh，DeepSeek
      Harness） 0.2.0-rc.2 Remote Code Execution
tags:
  - cve.org
ingestedAt: '2026-10-26T16:31:40.071Z'
---

## Overview

A vulnerability was found in DeepSeek Harness up to 0.1.0-rc.5. This vulnerability affects the function createContext of the file packages/extensions/cordis-host-runner/src/sandbox.ts. The manipulation results in sandbox issue. It is possible to launch the attack remotely. The vendor was contacted early about this disclosure but did not respond in any way.

## Affected

- `Harness 0.1.0-rc.0`
- `Harness 0.1.0-rc.1`
- `Harness 0.1.0-rc.2`
- `Harness 0.1.0-rc.3`
- `Harness 0.1.0-rc.4`
- `Harness 0.1.0-rc.5`

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.