CVE-2026-109375 in Deepsec
Summary
by MITRE • 10/13/2026
Vercel deepsec from 0.1.0 before 1.1.17 contains a link following vulnerability in extractTarballLocally that allows sandboxed code to write files outside the sandbox by planting links in result tarballs. Attackers controlling sandbox code, such as a prompt-injected coding agent, can plant symbolic or hard links in the host data directory to write arbitrary files on the orchestrator host.
Be aware that VulDB is the high quality source for vulnerability data.
Analysis
by VulDB Data Team • 10/13/2026
The vulnerability identified within Vercel deepsec versions prior to 1.1.17 represents a critical path traversal and file system manipulation flaw located specifically within the extractTarballLocally function. This component is responsible for unpacking tar archives, a common operation in software deployment and containerization workflows where code artifacts are extracted from compressed bundles into specific directories on the host machine or execution environment. The core technical deficiency lies in the insufficient validation of archive entries during the extraction process. Specifically, the implementation fails to adequately sanitize symbolic links and hard links contained within the tarball before writing them to the file system. In standard Unix-like operating systems, a symbolic link is a special type of file that acts as a pointer to another file or directory by name rather than containing data itself. When an archive contains such a link pointing to a path outside the intended sandboxed directory, and the extraction logic blindly follows this reference without checking if the target resides within the allowed boundaries, it results in a write operation occurring at an arbitrary location on the host system.
This flaw allows attackers who have control over the code executed within the sandbox environment to escalate their privileges significantly beyond the confines of that isolated space. By crafting a malicious tarball containing symbolic links or hard links that point to sensitive directories such as /etc, home directories, or application configuration files outside the designated workspace, an attacker can overwrite critical system files. This capability effectively breaks the isolation guarantees provided by the sandboxing mechanism. The operational impact is severe, as it enables arbitrary file write operations on the orchestrator host. An adversary could replace binary executables to achieve persistent code execution, modify configuration files to alter application behavior or steal credentials stored therein, or delete essential system components leading to a denial of service condition. In cloud-native environments where multiple tenants share underlying infrastructure, this vulnerability poses a risk not only to the immediate victim but potentially to other services running on the same host if they rely on shared resources compromised by such an attack.
The threat model for this vulnerability is particularly relevant in scenarios involving untrusted code execution or automated coding agents that may be subject to prompt injection attacks. If a large language model-based agent is instructed to generate and execute code, it might inadvertently create artifacts containing these malicious links if the underlying tooling lacks robust security controls. This aligns with CWE-22, which describes Improper Limitation of a Pathname to a Restricted Directory, commonly known as path traversal. Furthermore, this vulnerability facilitates lateral movement within the host environment once initial access is gained through sandboxed code execution. From an ATT&CK perspective, this behavior maps directly to Tactic TA0004 (Privilege Escalation) and specifically techniques such as T1564 (Host File System Modification). The ability to write arbitrary files allows for further exploitation vectors including the installation of backdoors or modification of authentication mechanisms.
Mitigation strategies must focus on strict input validation and secure file system handling practices during archive extraction. Developers should implement a whitelist approach where only absolute paths within the designated sandbox directory are permitted as targets for extracted links. Before creating any symbolic or hard link, the application must resolve the final path and verify that it remains strictly inside the allowed root directory. Additionally, using operating system features such as chroot jails or Linux namespaces can provide an additional layer of isolation to limit the impact even if a vulnerability is exploited. Upgrading Vercel deepsec to version 1.1.17 or later resolves this issue by patching the extractTarballLocally function with these necessary security checks. Organizations relying on automated code generation tools should also implement strict sandboxing policies and monitor for unusual file system activities that may indicate exploitation attempts of similar path traversal vulnerabilities in other components of their stack.