{"id":"CVE-2026-116367","kind":"vulnerability","aliases":["CVE-2026-116367"],"related":[],"title":"DeepSeek Harness: remotely reachable sandbox flaw in createContext, vendor unresponsive","description":"A vulnerability was found in DeepSeek Harness up to 0.1.0-rc.5. This vulnerability affects the function createContext of the file packages/extensions/cordis-host-runner/src/sandbox.ts. The manipulation results in sandbox issue. It is possible to launch the attack remotely. The vendor was contacted early about this disclosure but did not respond in any way.","summary":"DeepSeek Harness's cordis-host-runner runs model-written 'dynamic plugin' host code in a node:vm sandbox that exposes host-realm functions. Code can escape through harness.defineTool.constructor.constructor (or TextEncoder.constructor) to get the host process and run arbitrary commands. A prompt-injected model can reach it, and host-only packages need no user approval. VulDB lists 0.1.0-rc.0 to rc.5 as affected. Public reports show master v0.2.1-alpha.5 is still affected. No fix, vendor silent; upstream comments call the vm not a security boundary.","severity":"high","cvss":7.5,"epss":null,"exploited":false,"exploited_at":null,"products":[{"name":"deepseek-harness","fixed":[],"affected":">= 0.1.0-rc.0, <= 0.1.0-rc.5 (public reports: also master 0.2.1-alpha.5)","ecosystem":"npm"}],"ecosystems":[],"tags":["ai-agents","ai-tooling","deepseek-harness","node-vm","prompt-injection","sandbox"],"not_affected_if":["cordis-tools-disabled","disposable-container","no-untrusted-content"],"how_to_check":"- Check whether you run deepseek-harness / @deepseek-ai/dsh at any version, including 0.1.0-rc.x and later 0.2.x builds; no fixed version is known.\n- Check whether packages/extensions/cordis-host-runner/src/sandbox.ts exists and whether the cordis_define / cordis_run tools (tool-cordis) are enabled for your agent.","fix":"unknown: no fixed release; the vendor has not responded. Mitigation (from public reports, not vendor-confirmed): disable the cordis_define/cordis_run tools, run the harness in a disposable container/VM with no sensitive credentials (e.g. DEEPSEEK_API_KEY in .env), and do not let the agent read untrusted web or repo content.","status":"open","published_at":"2026-10-26T16:17:17+00:00","first_seen_at":"2026-10-26T16:31:01+00:00","triaged_at":"2026-10-26T16:33:01+00:00","updated_at":"2026-10-26T16:34:36+00:00","category":"ai-tooling","confidence":0.7,"triage":{"at":"2026-10-26T16:33:01Z","model":"claude-haiku-5-5","output":{"fix":"unknown","reach":"internet","title":"DeepSeek Harness: remotely reachable sandbox flaw in createContext, vendor unresponsive","impact":"high","summary":"DeepSeek Harness up to 0.1.0-rc.5 has a sandbox issue in the createContext function of the cordis-host-runner extension's sandbox.ts file. The sources say a remote attacker can trigger it, and the vendor did not respond to early disclosure.","category":"ai-tooling","nicknames":[],"who_cares":["deepseek-harness","ai-agents","sandbox"],"confidence":0.5,"needs_auth":"unknown","worst_case":"Sandbox boundary may be bypassed remotely by an attacker","analyst_note":"Confirm the exact impact of the createContext sandbox flaw and whether a fixed version exists, using the NVD entry at https://nvd.nist.gov/vuln/detail/CVE-2026-116367 and the upstream DeepSeek Harness repository.","how_to_check":"- Check whether the installed DeepSeek Harness version is `0.1.0-rc.5` or earlier.\n- Look for `packages/extensions/cordis-host-runner/src/sandbox.ts` in your deployment and whether it calls `createContext`.","needs_analyst":true,"not_affected_if":[],"who_is_affected":"Teams running DeepSeek Harness up to 0.1.0-rc.5 that load the cordis-host-runner extension, since the flaw sits in its sandbox code. The sources do not say which configurations expose it or whether it is on by default.","user_interaction":"unknown","needs_special_setup":"unknown","severity_if_unknown":"high"},"cost_usd":0.001118,"input_tokens":3336,"output_tokens":1568,"severity_before":"high"},"analyst_status":"done","analyst_note":"Confirm the exact impact of the createContext sandbox flaw and whether a fixed version exists, using the NVD entry at https://nvd.nist.gov/vuln/detail/CVE-2026-116367 and the upstream DeepSeek Harness repository.","search":"'-116367':13A,16A '-2026':12A,15A '0.1.0':97B,133C 'affect':102B,110B,137C 'agent':22B 'ai':21B,24B 'ai-ag':20B 'ai-tool':23B 'approv':94B 'arbitrari':76B 'attack':157C 'boundari':123B 'call':117B 'code':50B,62B 'command':77B 'comment':116B 'contact':162C 'cordi':40B 'cordis-host-runn':39B 'createcontext':8A,140C 'cve':11A,14A 'deepseek':1A,18A,27B,36B,129C 'deepseek-har':26B 'deepseek-harness':17A 'disclosur':166C 'dynam':47B 'earli':163C 'escap':64B 'expos':57B 'file':143C 'fix':112B 'flaw':6A 'found':127C 'function':61B,139C 'get':70B 'har':2A,28B,37B,130C 'harness':19A 'harness.definetool.constructor.constructor':66B 'host':41B,49B,59B,72B,88B 'host-on':87B 'host-realm':58B 'inject':34B,81B 'issu':150C 'launch':155C 'list':96B 'manipul':146C 'master':106B 'model':45B,82B 'model-written':44B 'need':91B 'node':30B,53B 'node-vm':29B 'packag':90B 'packages/extensions/cordis-host-runner/src/sandbox.ts':144C 'plugin':48B 'possibl':153C 'process':73B 'prompt':33B,80B 'prompt-inject':32B,79B 'public':103B 'rc.0':98B 'rc.5':100B,134C 'reach':84B 'reachabl':4A 'realm':60B 'remot':3A,158C 'report':104B 'respond':170C 'result':147C 'run':43B,75B 'runner':42B 'sandbox':5A,35B,55B,149C 'secur':122B 'show':105B 'silent':114B 'still':109B 'textencoder.constructor':68B 'tool':25B 'unrespons':10A 'upstream':115B 'user':93B 'v0.2.1-alpha.5':107B 'vendor':9A,113B,160C 'vm':31B,54B,119B 'vuldb':95B 'vulner':125C,136C 'way':173C 'written':46B","nicknames":[],"mitigations":[],"who_affected":"Teams running DeepSeek Harness up to 0.1.0-rc.5 that load the cordis-host-runner extension, since the flaw sits in its sandbox code. The sources do not say which configurations expose it or whether it is on by default.","tier":"B","verified":{},"analyst_revisit_at":null,"first_public_at":"2026-10-26T16:17:17+00:00","kev":null,"cvss_vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","cvss_by":"cna@vuldb.com","poc_count":1,"sources":[{"source":"nvd","external_id":"CVE-2026-116367","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-116367","severity":null,"published_at":"2026-10-26T16:17:17+00:00","modified_at":"2026-10-26T16:17:17+00:00","first_seen_at":"2026-10-26T16:31:01+00:00","fetched_at":"2026-10-26T16:31:01+00:00","note":null},{"source":"analyst","external_id":"CVE-2026-116367:837","url":null,"severity":null,"published_at":"2026-10-26T16:34:36+00:00","modified_at":"2026-10-26T16:34:36+00:00","first_seen_at":"2026-10-26T16:34:36+00:00","fetched_at":"2026-10-26T16:34:36+00:00","note":"VulDB (secondary; NVD page empty) lists rc.0-rc.5, no fix, vendor silent. Public GitHub discussions (#9977 PoC, #1441, #451) show same cordis vm escape still works on master v0.2.1-alpha.5 (2026-10-16), so affected range is wider than rc.5; upstream code comment says vm is not containment (known design limit). No vendor advisory, nothing verified."}],"documents":[{"id":3967,"url":"https://vuldb.com/vuln/426331","title":"VulDB VDB-426331 CVE-2026-116367","kind":"advisory","source":"analyst","text":null,"published_at":null,"relation":"advisory","confidence":null,"note":null},{"id":3968,"url":"https://github.com/deepseek-ai/deepseek-harness/discussions/9977","title":"DeepSeek Harness: cordis dynamic plugin node:vm sandbox escape (master v0.2.1-alpha.5)","kind":"issue","source":"analyst","text":null,"published_at":null,"relation":"poc","confidence":null,"note":null},{"id":3969,"url":"https://github.com/deepseek-ai/deepseek-harness/discussions/1441","title":"Security review: dynamic plugin vm sandbox host escape, PoC verified","kind":"issue","source":"analyst","text":null,"published_at":null,"relation":"describes","confidence":null,"note":null}],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}