EUVD-2026-88334
GHSA-23q9-h232-4q79
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessObtain low-priv execution inside sandbox
-
ExploitAbuse mount handling in Landlock profile
-
ExecutionEscape isolation boundary
-
ImpactAccess resources outside sandbox
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A06:2025 - Insecure Design
ASVS 5.0
V15 - Secure Coding and Architecture Component isolation
|
| Exploitation Conditions | Exploitation requires the attacker to already have local, low-privileged code execution inside a deepseek-harness sandbox using the Landlock Backend (the profiles.ts mount configuration in packages/sandbox/sandbox-local). It is therefore only exploitable where deepseek-harness's local sandbox is actually used as a trust boundary to run untrusted agent/tool code; it is not remotely reachable (AV:L) and requires no user interaction (UI:N) but does require PR:L. Limiting factors: local access only, dependence on the Landlock/local-sandbox deployment mode, affected pre-release versions up to 0.1.7-rc.2, and no impact where the sandbox is not relied upon for security. |
| Impact | This is a genuine but low-to-moderate priority local sandbox-escape issue, not a remote critical. The CVSS 4.0 vector (AV:L/AC:L/AT:N/PR:L/UI:N) confirms exploitation requires local presence and low-level privileges - i.e. the attacker must already be executing inside the deepseek-harness sandbox. The vendor 4.0 base score of 4.8 with uniformly Low impacts (VC/VI/VA:L and subsequent-system SC/SI/SA:L) is consistent with a compartmentalization failure (CWE-653) rather than a full-privilege takeover. Publicly available exploit code exists (GitHub, titled SECURITY-MOUNT-ESCAPE), which raises real-world exploitability, but there is NO EPSS score and NO CISA KEV listing provided, so there is no evidence of active or widespread exploitation - the POC signal and exploitation signal must not be conflated. Notably the vendor was contacted early and did not respond, and no patch is confirmed available, so affected deployments cannot be trivially remediated. Net: real priority only for environments that actually rely on deepseek-harness's local sandbox as a security boundary; for everyone else it is a low-real-risk local issue. |
| Exploit ScenarioDerived | An attacker who can run code inside a deepseek-harness local sandbox (e.g. untrusted agent/tool code executed under the Landlock backend) abuses a mount-related weakness in the profiles.ts sandbox profile to break out of the intended isolation and reach files or resources outside the sandbox. A public proof-of-concept (SECURITY-MOUNT-ESCAPE) demonstrates the escape, and because the attack complexity is low (AC:L) it is straightforward once local sandboxed execution is achieved. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Sep 28, 2026
Local sandbox escape in deepseek-ai deepseek-harness up to 0.1.7-rc.2 lets a low-privileged attacker who already has code execution inside the Landlock-backed local sandbox break the intended isolation boundary through crafted mount profiles in packages/sandbox/sandbox-local/src/profiles.ts (CWE-653). The impact is limited to confidentiality, integrity, and availability (all Low), scored 4.8 under CVSS 4.0, and it is only relevant where the harness local sandbox is actually used as a trust boundary for untrusted agent or tool code; it is not remotely reachable and requires no user interaction but does require local, low-privileged access (AV:L/PR:L/UI:N). Publicly available exploit code exists (a GitHub write-up demonstrates the mount-escape technique), the vendor was contacted early but did not respond, and no vendor-released patch has been identified, making this a genuine but low-to-moderate priority local sandbox-escape issue rather than a remote critical.
RemediationAI
No vendor-released patch identified at time of analysis: the vendor was contacted early about the disclosure but did not respond, and no fixed version is specified in the available data, so do not assume any release up to and including 0.1.7-rc.2 is fixed. Track https://vuldb.com/vuln/410949 and the deepseek-ai/deepseek-harness repository for a patched release and apply it as soon as it is published. Until then, the most effective compensating control is to stop treating the Landlock local sandbox as a security boundary for untrusted code: run agent or tool workloads inside a stronger isolation primitive such as a microVM (KVM/Firecracker), gVisor, or a container that combines user namespaces, seccomp, and read-only mounts, at the cost of higher per-workload overhead and possible tool incompatibility with restrictive filesystem layouts. If stronger isolation is not feasible, restrict which local users can execute code inside the harness sandbox (the exploit requires PR:L), disable use of the local Landlock mount-profile backend for untrusted workloads, and add defense-in-depth with AppArmor or SELinux profiles; be aware that disabling or bypassing the Landlock backend entirely may reduce isolation for other workloads that rely on it, and that an AppArmor/SELinux layer requires maintenance and can break tools that need broader filesystem access. Review and tighten the mount rules generated from packages/sandbox/sandbox-local/src/profiles.ts, and consult the public exploit write-up at https://github.com/Ruoyyy/My_vulnerable/blob/main/SECURITY-MOUNT-ESCAPE.en.md to validate that the specific escape path is blocked in your environment.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
The issue affects the local sandbox backend of deepseek-harness, which relies on Landlock, the Linux Security Module (LSM) that lets unprivileged processes restrict their own filesystem and mount access as a self-imposed sandbox. The vulnerable component is the profile configuration logic in packages/sandbox/sandbox-local/src/profiles.ts, where mount rules are assembled for sandboxed agent or tool execution; improper enforcement of those rules maps to CWE-653 (Improper Isolation or Compartmentalization), meaning the mount restrictions can be bypassed so the sandboxed code escapes its intended compartment. The public CPE record cpe:2.3:a:deepseek-ai:deepseek-harness:*:*:*:*:*:*:*:* reflects that all versions are treated as potentially affected by this advisory, with the reported vulnerable range extending through the pre-release 0.1.7-rc.2. The CVSS 4.0 vector (AV:L/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:L/SI:L/SA:L/E:P) confirms a local attack path with low privileges, no user interaction, and Proof-of-Concept exploit maturity, while the independent assessment (CVSS 3.1 AV:L/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:L) agrees that this is a local sandbox-escape class issue with low impact and scope-change characteristics rather than a remotely exploitable flaw.
Know when Deepseek Harness gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:L/SI:L/SA:L/E:P
Local low-priv attacker inside the sandbox (AV:L/PR:L/AC:L); escaping the sandbox crosses the security authority so S:C, with limited Low impact on resources reached outside.
Primary rating from Vendor (VulDB).
CVSS VectorVendor: VulDB
Lifecycle Timeline
3DescriptionCVE.org
A vulnerability has been found in deepseek-ai deepseek-harness up to 0.1.7-rc.2. Affected is an unknown function of the file packages/sandbox/sandbox-local/src/profiles.ts of the component Landlock Backend. Such manipulation leads to improper isolation or compartmentalization. The attack must be carried out locally. The exploit has been disclosed to the public and may be used. It is advisable to implement a patch to correct this issue. The vendor was contacted early about this disclosure but did not respond in any way.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
VulDB
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Information disclosure occurs when an application unintentionally exposes sensitive data that aids attackers in reconnaissance or directly compromises security.
More in Deepseek Harness
View allDeepSeek Harness versions up to and including 0.1.1-rc.2 do not properly enforce the intended behavioral workflow within
Path traversal in the DeepSeek deepseek-harness boot tooling (through 0.1.7-rc.2) lets an attacker who can influence the
Local information disclosure in deepseek-ai DeepSeek Harness through 0.1.5-rc.3 allows an authenticated local attacker w
Exploit-DB