DeepSeek Harness EUVD-2026-109917

The flaw is in the createContext function of packages/extensions/cordis-host-runner/src/sandbox.ts in DeepSeek Harness (all 0.1.0-rc.0 through 0.1.0-rc.5), i.e. it requires a deployment running the cordis-host-runner extension's sandbox. Per the CVSS 4.0 vector the attack is remote and unauthenticated (AV:N, PR:N) but is GATED by passive user interaction (UI:P) - a user of the affected application must take some action for the manipulation to trigger - which meaningfully limits drive-by exploitation. Impact is capped at LOW across confidentiality, integrity and availability with no scope change, so a successful attack yields limited sandbox-boundary effects rather than host takeover. The exact manipulation that triggers the sandbox issue is not described in the available sources, and no non-default configuration is identified as a prerequisite. No vendor patch or fixed version is listed in the evidence (vendor did not respond).

This is a moderate-severity, lower-priority issue by most signals. The only quantitative source is a CVSS 4.0 vector (5.3, Medium) reported by VulDB: AV:N (network), AC:L (low complexity), AT:N, PR:N (no privileges), UI:P (passive user interaction required), with uniformly LOW impact to confidentiality, integrity and availability (VC:L/VI:L/VA:L) and no scope change (SC:N/SI:N/SA:N). The vuln.today decision label is 'this_month' - a routine-remediation priority, NOT act_now or emergency. There is no CISA KEV listing and no EPSS score in the provided data, so exploitation-probability cannot be quantified. No confirmed public exploit code is present - references are VulDB informational/CTI pages plus a submission link, not verified working exploit code. The CWE is CWE-265 (privilege/sandbox issue) and the flaw is a 'sandbox issue' in a JavaScript createContext routine, yet the capped LOW impacts indicate limited blast radius rather than full code execution or broad disclosure. Conflicting/soft signals to flag: the Tags label this 'Information Disclosure' (confidentiality-oriented) while the vendor-style vector assigns LOW integrity and availability impact too - the actual trigger and the precise impact split are not described in the available sources. The vendor (DeepSeek) was contacted but did not respond, so no vendor confirmation, patch, or affected-version authority exists. Net: a real but low-urgency finding, dominated by a very small deployment footprint and absence of exploitation evidence rather than by technical severity.

A remote attacker lures a user of a DeepSeek Harness-based application (≤0.1.0-rc.5) into triggering the vulnerable createContext path in the cordis-host-runner sandbox, where crafted input abuses the sandbox boundary to leak limited information or make minor unauthorized reads/writes within the host context. Exploitation needs passive user interaction (UI:P) but no authentication (PR:N); the precise trigger is not described in the available sources. No verified public exploit code was identified - only VulDB advisory/CTI references exist.