---
id: "CVE-2026-116367"
kind: "vulnerability"
aliases: ["CVE-2026-116367"]
title: "DeepSeek Harness: remotely reachable sandbox flaw in createContext, vendor unresponsive"
severity: "high"
cvss: 7.5
epss: null
exploited: false
status: "open"
category: "ai-tooling"
products: [{"name": "deepseek-harness", "fixed": [], "affected": ">= 0.1.0-rc.0, <= 0.1.0-rc.5 (public reports: also master 0.2.1-alpha.5)", "ecosystem": "npm"}]
ecosystems: []
tags: ["ai-agents", "ai-tooling", "deepseek-harness", "node-vm", "prompt-injection", "sandbox"]
not_affected_if: ["cordis-tools-disabled", "disposable-container", "no-untrusted-content"]
published_at: "2026-10-26T16:17:17+00:00"
first_seen_at: "2026-10-26T16:31:01+00:00"
updated_at: "2026-10-26T16:34:36+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-116367", "first_seen_at": "2026-10-26T16:31:01+00:00"}, {"source": "analyst", "url": null, "first_seen_at": "2026-10-26T16:34:36+00:00"}]
---

# DeepSeek Harness: remotely reachable sandbox flaw in createContext, vendor unresponsive

DeepSeek Harness's cordis-host-runner runs model-written 'dynamic plugin' host code in a node:vm sandbox that exposes host-realm functions. Code can escape through harness.defineTool.constructor.constructor (or TextEncoder.constructor) to get the host process and run arbitrary commands. A prompt-injected model can reach it, and host-only packages need no user approval. VulDB lists 0.1.0-rc.0 to rc.5 as affected. Public reports show master v0.2.1-alpha.5 is still affected. No fix, vendor silent; upstream comments call the vm not a security boundary.

_Summary, check and fix written by a model from the sources; labelled as such._

## Affected

- npm:deepseek-harness affected >= 0.1.0-rc.0, <= 0.1.0-rc.5 (public reports: also master 0.2.1-alpha.5) fixed ?

## How to check

- Check whether you run deepseek-harness / @deepseek-ai/dsh at any version, including 0.1.0-rc.x and later 0.2.x builds; no fixed version is known.
- Check whether packages/extensions/cordis-host-runner/src/sandbox.ts exists and whether the cordis_define / cordis_run tools (tool-cordis) are enabled for your agent.

## Fix

unknown: no fixed release; the vendor has not responded. Mitigation (from public reports, not vendor-confirmed): disable the cordis_define/cordis_run tools, run the harness in a disposable container/VM with no sensitive credentials (e.g. DEEPSEEK_API_KEY in .env), and do not let the agent read untrusted web or repo content.

## Timeline

- 2026-10-26T16:31:01+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-116367
- 2026-10-26T16:34:36+00:00 analyst — VulDB (secondary; NVD page empty) lists rc.0-rc.5, no fix, vendor silent. Public GitHub discussions (#9977 PoC, #1441, #451) show same cordis vm escape still works on master v0.2.1-alpha.5 (2026-10-16), so affected range is wider than rc.5; upstream code comment says vm is not containment (known design limit). No vendor advisory, nothing verified.

## Documents

- [advisory] VulDB VDB-426331 CVE-2026-116367 https://vuldb.com/vuln/426331
- [describes] Security review: dynamic plugin vm sandbox host escape, PoC verified https://github.com/deepseek-ai/deepseek-harness/discussions/1441
- [poc] DeepSeek Harness: cordis dynamic plugin node:vm sandbox escape (master v0.2.1-alpha.5) https://github.com/deepseek-ai/deepseek-harness/discussions/9977

## From the sources

A vulnerability was found in DeepSeek Harness up to 0.1.0-rc.5. This vulnerability affects the function createContext of the file packages/extensions/cordis-host-runner/src/sandbox.ts. The manipulation results in sandbox issue. It is possible to launch the attack remotely. The vendor was contacted early about this disclosure but did not respond in any way.

---

_Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai_