EUVD-2026-97146
GHSA-5mvr-2xwh-9v9q
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessObtain local low-privileged access
-
ExploitInvoke Sandbox spawn with crafted Profile argument
-
ExecutionTrigger sandbox control weakness
-
ImpactGain limited privilege escalation on host
Vulnerability Assessment
| Weakness |
CWE
ASVS 5.0
V8 - Authorization Permission and access control
MITRE ATT&CK
1 technique across 1 tactic: Privilege Escalation The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | Exploitation requires local access to a host running deepseek-ai deepseek-harness at or below version 0.1.1-rc.2, plus pre-existing low-level privileges (PR:L) sufficient to invoke the Sandbox component's spawn function and control its 'Profile' argument. The specific prerequisite is the ability to supply a manipulated 'Profile' value to spawn. Limiting factors that reduce real-world risk: the attack vector is local only (AV:L - no remote/network exploitation), the attacker must already be authenticated with low privileges, and impact is capped at Low for confidentiality, integrity, and availability with no scope change to other systems. |
| Impact | This is a low-priority issue despite being publicly disclosed. The vendor-supplied CVSS 4.0 vector (AV:L/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L) yields a base score of only 1.9, reflecting that exploitation requires local access and pre-existing low-level privileges (PR:L), and produces only Low confidentiality, integrity, and availability impact with no scope/subsequent-system change. The E:P flag indicates proof-of-concept exploit code exists, and the description confirms public disclosure - so publicly available exploit code exists - but this is NOT active exploitation: the CVE is not in CISA KEV and no EPSS score was provided. There is a notable signal-vs-severity contrast: a public PoC normally raises attention, yet the local-only vector, required authentication, and uniformly Low impacts keep real-world risk minimal. The reporter is VulDB (cna@vuldb.com), a crowd-sourced source, and the vendor did not respond to disclosure, so affected-version boundaries and fix availability are unconfirmed. No EPSS probability is available to gauge exploitation likelihood, which should be noted as a gap. |
| Exploit ScenarioDerived | A local, already-authenticated user on a host running deepseek-harness (≤0.1.1-rc.2) manipulates the 'Profile' argument passed to the Sandbox component's spawn function to trigger a sandbox escape/privilege issue. A proof-of-concept has been publicly disclosed, so the technique is reproducible, but the attacker must first have local access and low-level privileges on the system. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Oct 12, 2026
Local authenticated attackers with low privileges can bypass or break the Sandbox component in deepseek-harness up to 0.1.1-rc.2 by manipulating the 'Profile' argument to the spawn function, resulting in a sandbox issue that may lead to limited privilege escalation. Publicly available exploit code exists, but the impact is capped at Low for confidentiality, integrity, and availability with no scope change, making this a low-priority issue. The vendor did not respond to disclosure, and no patch has been identified.
RemediationAI
No vendor-released patch has been identified at time of analysis, and the vendor did not respond to disclosure. As compensating controls, restrict local access to hosts running deepseek-harness to trusted users only, since exploitation requires local access and low privileges. Monitor or audit invocations of the Sandbox component's spawn function, particularly any unusual 'Profile' argument values, as this is the manipulation vector. Consider running the harness within an isolated container or virtual machine to limit the impact of a sandbox escape. These controls reduce risk but do not fix the underlying flaw; upgrading will be necessary once a patch is released. Consult the VulDB entry at https://vuldb.com/vuln/416567 for updates.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
The vulnerability resides in the spawn function of the Sandbox component within deepseek-harness, an AI agent execution harness. The root cause is classified as CWE-264 (Permissions, Privileges, and Access Controls), meaning the sandbox does not properly validate or restrict the 'Profile' argument before spawning a process, allowing an attacker who can control that argument to bypass sandbox restrictions. Exploitation is local only (AV:L) and requires low privileges (PR:L), as indicated by the CVSS 4.0 vector (E:P denotes a proof-of-concept exploit). The independent assessment using CVSS 3.1 confirms a base score consistent with low impact (C:L/I:L/A:L, S:U, PR:L, AV:L). No CPE data was provided, but the affected component is specifically the Sandbox module of deepseek-harness.
Know when the next one hits your stack
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P
Local-only sandbox flaw invoked by an authenticated low-privileged user manipulating a spawn Profile argument, so AV:L/PR:L/AC:L with limited Low impact across C/I/A and no scope change.
Primary rating from Vendor (vuldb).
CVSS VectorVendor: vuldb
DescriptionCVE.org
A vulnerability was determined in deepseek-ai deepseek-harness up to 0.1.1-rc.2. The impacted element is the function spawn of the component Sandbox. Executing a manipulation of the argument Profile can lead to sandbox issue. It is possible to launch the attack on the local host. The exploit has been publicly disclosed and may be utilized. The vendor was contacted early about this disclosure but did not respond in any way.
Threat Intelligence Overview
NVD
CVE.org
EPSS
VulDB
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Privilege escalation occurs when an attacker leverages flaws in access control mechanisms to gain permissions beyond what they were originally granted.
Exploit-DB