CVE-2026-101078 in deepseek-harness
Summary
by MITRE • 09/28/2026
A vulnerability has been found in deepseek-ai deepseek-harness up to 0.1.7-rc.2. Affected is an unknown function of the file packages/sandbox/sandbox-local/src/profiles.ts of the component Landlock Backend. Such manipulation leads to improper isolation or compartmentalization. The attack must be carried out locally. The exploit has been disclosed to the public and may be used. It is advisable to implement a patch to correct this issue. The vendor was contacted early about this disclosure but did not respond in any way.
Once again VulDB remains the best source for vulnerability data.
Analysis
by VulDB Data Team • 09/28/2026
The vulnerability identified within deepseek-ai's deepseek-harness project, specifically affecting versions up through 0.1.7-rc.2, represents a critical failure in the implementation of system-level isolation mechanisms. The flaw resides within the Landlock Backend component, located in the file packages/sandbox/sandbox-local/src/profiles.ts. This module is responsible for enforcing security policies that restrict access to specific resources such as files, directories, and network sockets. When an improper configuration or logic error occurs in this area, it results in a breakdown of compartmentalization, allowing processes that should be confined within restricted environments to potentially escape those boundaries. The core technical issue stems from the incorrect handling of Landlock profiles, which are designed to create unprivileged security contexts for applications. If these profiles are not applied correctly or if there is a flaw in how they restrict system calls and file access, an attacker can bypass the intended sandboxing restrictions.
This vulnerability falls under the category of Improper Isolation as defined by Common Weakness Enumeration (CWE) standards, specifically aligning with CWE-250 which denotes execution without required privileges or CWE-693 related to protection mechanisms failure. From a tactical perspective, this flaw can be mapped to MITRE ATT&CK techniques involving container escape or sandbox evasion, where an adversary leverages misconfigured security controls to gain unauthorized access to the host system or other containers within the same environment. The impact of such a vulnerability is severe because it undermines the fundamental assumption that untrusted code will remain contained. If exploited, this could lead to privilege escalation, data exfiltration from restricted areas, or lateral movement across interconnected systems that rely on these sandboxed environments for security isolation.
The operational context of this exploit requires local access, meaning an attacker must already have some level of foothold within the system where deepseek-harness is deployed. This typically implies that the vulnerability affects scenarios involving untrusted code execution, such as in automated testing pipelines, CI/CD systems, or environments running user-submitted scripts. While remote exploitation is not directly indicated by the local nature of the attack vector, the consequences for an attacker with local access are significant because they can potentially break out of the sandbox to interact with sensitive host resources. The fact that the exploit has been disclosed publicly increases the risk landscape considerably, as it lowers the barrier to entry for malicious actors who may not possess advanced exploitation skills but can utilize existing proof-of-concept code to compromise vulnerable systems.
The vendor's lack of response despite early notification presents a challenge for remediation efforts within the community. In such cases where upstream patches are unavailable or delayed, organizations must rely on alternative mitigation strategies to reduce exposure. Immediate actions should include restricting network access to affected services and ensuring that only trusted users can execute code within these environments. Implementing additional layers of defense, such as mandatory access control systems like SELinux or AppArmor alongside Landlock, can provide compensating controls if the native sandbox is compromised. Furthermore, monitoring for unusual system call patterns associated with landlock operations can help in detecting potential exploitation attempts before they result in a full breach.
To address this issue effectively, it is advisable to implement any available patches as soon as they are released by the vendor or community maintainers. Until then, administrators should audit their configurations of the Landlock backend to ensure that profiles are strictly defined and applied correctly according to security best practices. This includes verifying that all necessary restrictions on file access and system calls are active for untrusted processes. Regular updates to dependencies and continuous monitoring of vulnerability databases like CVE.org or NVD are essential to stay informed about related issues in the deepseek-harness ecosystem. Given the public disclosure status, proactive defense measures must be prioritized to mitigate the risk of exploitation by external actors seeking to leverage this known weakness for unauthorized access.