Live › vulnerability › CVE-2026-116367
Go to dashboardDeepSeek Harness's cordis-host-runner runs model-written 'dynamic plugin' host code in a node:vm sandbox that exposes host-realm functions. Code can escape through harness.defineTool.constructor.constructor (or TextEncoder.constructor) to get the host process and run arbitrary commands. A prompt-injected model can reach it, and host-only packages need no user approval. VulDB lists 0.1.0-rc.0 to rc.5 as affected. Public reports show master v0.2.1-alpha.5 is still affected. No fix, vendor silent; upstream comments call the vm not a security boundary.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-26 16:31 UTC. All times on this page are UTC.
Teams running DeepSeek Harness up to 0.1.0-rc.5 that load the cordis-host-runner extension, since the flaw sits in its sandbox code. The sources do not say which configurations expose it or whether it is on by default.
| Product | Ecosystem | Affected | Fixed in |
|---|---|---|---|
| deepseek-harness | npm | >= 0.1.0-rc.0, <= 0.1.0-rc.5 (public reports: also master 0.2.1-alpha.5) | – |
Each row is the first time that source carried this signal. The analyst’s rows are its own findings.
A vulnerability was found in DeepSeek Harness up to 0.1.0-rc.5. This vulnerability affects the function createContext of the file packages/extensions/cordis-host-runner/src/sandbox.ts. The manipulation results in sandbox issue. It is possible to launch the attack remotely. The vendor was contacted early about this disclosure but did not respond in any way.
This page as .md · .json · in your agent: get_signal("CVE-2026-116367")
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.