Vercel deepsec CVE-2026-109375

Exploitation requires the attacker to control code executing inside the deepsec sandbox (the description names a prompt-injected coding agent as the canonical case). With that foothold, the attacker plants symbolic or hard links in the host data directory so they are bundled into a result tarball; the escape occurs only when the orchestrator calls extractTarballLocally, whose unsafe extraction follows those links and writes outside the sandbox onto the orchestrator host. Limiting factors that reduce real-world risk: (1) attacker must already achieve code/output control within the sandbox; (2) the orchestrator must extract the attacker-influenced result tarball (passive UI); (3) an attack requirement (AT:P) applies - the link-following extraction must succeed; (4) only deepsec versions 0.1.0 through before 1.1.17 are affected - 1.1.17 filters symlinks during archiving/extraction (via the tar ^7.5.13 dependency). Impact is confined to file-write/integrity on the host; no confidentiality or availability impact is described.

This is a medium-severity (CVSS 4.0 base 4.9) arbitrary-file-write / link-following issue (CWE-59) whose real-world priority is moderate and highly conditional. The CVSS 4.0 vector (AV:N/AC:L/AT:P/PR:N/UI:P, impact SI:H, all vulnerable-system impacts N) tells a precise story: the damage lands on a SUBSEQUENT system (the orchestrator host) rather than the sandbox itself, impact is integrity-only (no confidentiality or availability), an attack requirement (AT:P) exists, and passive user interaction (UI:P) - the orchestrator extracting a result tarball - is needed. No EPSS score, CISA KEV entry, or public POC was provided, so there is no signal of active or probable exploitation; this reads as a hardening fix in an AI-agent sandbox product, not an urgent in-the-wild threat. The 'RCE' tag overstates the confirmed impact - the CVSS reflects file-write (integrity) only; arbitrary file write on the orchestrator host is a plausible path TO code execution but is not scored or described as confirmed RCE, so treat RCE as a potential escalation, not established fact. The crucial caveat: PR:N understates a real precondition - the attacker must already control code running inside the deepsec sandbox (e.g., a prompt-injected coding agent). That precondition is central to deepsec's threat model (it exists precisely to contain untrusted agent code), which is what makes this a genuine sandbox-escape concern despite the modest numeric score.

An attacker who can influence the code or output of a coding agent running inside a deepsec sandbox - for example via prompt injection - plants a symbolic or hard link in the sandbox's host data directory so it is captured in the result tarball. When the orchestrator later invokes extractTarballLocally to unpack that tarball, the extraction follows the planted link and writes attacker-chosen files outside the sandbox onto the orchestrator host, escaping containment. No public exploit code was identified at time of analysis, and the attack requires the orchestrator to extract the attacker-influenced tarball (passive user interaction).