CVE-2026-116367

A vulnerability was found in DeepSeek Harness up to 0.1.0-rc.5. This vulnerability affects the function createContext of the file packages/extensions/cordis-host-runner/src/sandbox.ts. The manipulation results in sandbox issue. It is possible to launch the attack remotely. The vendor was contacted early about this disclosure but did not respond in any way.

CVSS 4.0

5.3CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N

CVSS 3.1

6.3CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:L

CWEs

CWE-264, CWE-265

Published

2026-10-26

Modified

2026-10-26

Record from

the NVD, synced 2026-10-26

References

• https://vuldb.com/cve/CVE-2026-116367
• https://vuldb.com/submit/1012736
• https://vuldb.com/vuln/426331
• https://vuldb.com/vuln/426331/cti

Check your stackJSON