Track vulnerabilities like this one. Sign up free to get alerted when software you use is affected.

CVE-2026-101078: deepseek-harness up to 0.1.7-rc.2 may break local sandbox isolation

CVE-2026-101078 · published 21 days ago

Summary

The deepseek-harness version 0.1.7-rc.2 contains a mistake in the Landlock component that can let someone running code on the same machine escape the intended sandbox protections. This could allow a local attacker to access files or resources they should not reach. Apply the available patch or upgrade to a newer version as soon as possible.

Original advisory text

A vulnerability has been found in deepseek-ai deepseek-harness up to 0.1.7-rc.2. Affected is an unknown function of the file packages/sandbox/sandbox-local/src/profiles.ts of the component Landlock Backend. Such manipulation leads to improper isolation or compartmentalization. The attack must be carried out locally. The exploit has been disclosed to the public and may be used. It is advisable to implement a patch to correct this issue. The vendor was contacted early about this disclosure but did not respond in any way.

References

Fix within

Internet-facing 60 days

Internal At next upgrade

Not known to be exploited
Needs hands-on effort to exploit
Gives an attacker partial control

Severity

1.9 Low

Exploitation

<1% chance of attack within 30 days

Type

CWE-653Improper Isolation or Compartmentalization

Timeline

Published28 Sep 2026

Updated30 Sep 2026

First seen28 Sep 2026

Sources

CVE-2026-101078 · NVD

Track software like this

Free during beta