EUVD-2026-88402
GHSA-m9ww-cpfc-8cf2
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessGain code-submission access to sandbox (PR:L)
-
ExploitCraft malicious payload for run_code
-
ExecutionEscape/abuse worker containment
-
ImpactAccess host resources beyond isolation
Vulnerability Assessment
| Weakness |
CWE
ASVS 5.0
V8 - Authorization Permission and access control
MITRE ATT&CK
1 technique across 1 tactic: Privilege Escalation The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | Exploitation requires the ability to submit/execute code through the deepseek-harness Code Mode Sandbox's run_code function (PR:L) - i.e., a deployment that exposes this code-execution harness to attacker-supplied code. The vulnerability is only meaningful for deployments that mistakenly treat the sandbox worker as a security boundary; the vendor explicitly documents it is NOT one, so a correctly-informed operator would not rely on it for isolation. Limiting factors: it is a pre-release (0.1.0-rc.7) niche library with tiny deployment footprint, requires the attacker to already have code-submission privileges (PR:L, not fully unauthenticated), and technical impact is low across confidentiality/integrity/availability with no subsequent-system (scope) impact. |
| Impact | This is a low-to-moderate real-world risk that should not be over-prioritized on CVSS alone. The vendor's CVSS 4.0 base of 5.3 (AV:N/AC:L/AT:N/PR:L/UI:N with only VC:L/VI:L/VA:L and no subsequent-system impact) already reflects modest technical impact, and the most decisive signal is contextual: DeepSeek's own code, SAFETY.md, and design notes EXPLICITLY document the Code Mode Sandbox worker as 'containment, not a security boundary.' This means the reported 'sandbox issue' in run_code is a documented non-guarantee rather than a broken security promise - anyone relying on it as a trust boundary is misusing it. No EPSS score, no CISA KEV listing, and no public exploit code are present in the input, so there is no evidence of active exploitation or automation. The sole source is VulDB (cna@vuldb.com), an aggregator submission, with no NVD analysis or vendor advisory, and the vendor did not respond to disclosure. CWE-264 (permissions/privileges) and the 'Privilege Escalation' tag are broad; the underlying issue is really sandbox/isolation escape. Net: real but narrow - a design-acknowledged limitation in a pre-release, niche product, not a widespread emergency. |
| Exploit ScenarioDerived | An attacker who can submit code to a service that runs untrusted code inside deepseek-harness's Code Mode Sandbox crafts input to the run_code function that escapes or abuses the worker's weak containment, gaining access beyond the intended isolation (e.g., reading host resources or affecting the executing process). The attack is remote (AV:N) but requires the ability to submit code (PR:L). No public proof-of-concept is identified at time of analysis, and the vendor itself states the worker was never intended as a security boundary. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Sep 28, 2026
Sandbox containment failure in the deepseek-ai deepseek-harness Code Mode Sandbox (up to and including 0.1.0-rc.7) allows remote, low-privileged attackers who can submit code through the run_code function to escape the worker's intended containment. The vendor's own SAFETY.md and design notes state the worker is "containment, not a security boundary," so the flaw primarily harms deployments that mistakenly rely on it for isolation; there is no public exploit identified at time of analysis and the pre-release, niche nature of the library keeps real-world risk low-to-moderate. Impact is limited to low confidentiality, integrity, and availability effects on the harness itself, with no downstream-scope compromise.
RemediationAI
No vendor-released patch identified at time of analysis; the vendor was contacted early but did not respond, so no fixed version is confirmed. The primary compensating control is to stop treating the Code Mode Sandbox worker as a security boundary, as the vendor's SAFETY.md already states, and instead run the harness inside a disposable, least-privilege container or VM with dropped Linux capabilities, a read-only root filesystem, a restrictive seccomp profile, and no network egress - accepting the added latency and operational overhead of true isolation. Restrict access to the run_code function to trusted operators who are already permitted to submit code, which directly removes the PR:L prerequisite but limits legitimate functionality for multi-tenant use. Log and review all submitted code and worker activity for containment escapes, trading storage and analyst effort for detection coverage. Additional tracking details are available at https://vuldb.com/cve/CVE-2026-101102 and https://vuldb.com/vuln/410977; no patched release should be assumed until the vendor publishes one.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
The affected component is the Code Mode Sandbox of the deepseek-ai deepseek-harness library, specifically the run_code function that executes attacker-supplied code inside a worker process. Classified as CWE-264 (Permissions, Privileges, and Access Control), the root cause is improper enforcement of the privilege/access separation between executed code and the harness host, allowing the worker's containment to be bypassed. The CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:L/UI:N) and our independent assessment (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L) agree the attack is remote, requires the attacker to already possess the ability to submit code for execution (PR:L), and yields only low-level impact within the same security scope. Because the vendor explicitly documents the worker as containment rather than a security boundary, the vulnerability is best understood as a design-trust issue: operators who treat the sandbox as an isolation boundary inherit risk that the vendor never claimed to mitigate.
Know when the next one hits your stack
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N
Remote code submission needed so AV:N/PR:L; low impact across C/I/A; scope kept Unchanged to align with vendor's SC:N given the worker is a documented non-boundary.
Primary rating from Vendor (vuldb).
CVSS VectorVendor: vuldb
DescriptionCVE.org
A vulnerability was found in deepseek-ai deepseek-harness up to 0.1.0-rc.7. Impacted is the function run_code of the component Code Mode Sandbox. The manipulation results in sandbox issue. The attack can be executed remotely. The vendor's own code, SAFETY.md, and design notes all explicitly state the worker is "containment, not a security boundary". The vendor was contacted early about this disclosure but did not respond in any way.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
VulDB
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Privilege escalation occurs when an attacker leverages flaws in access control mechanisms to gain permissions beyond what they were originally granted.
Exploit-DB