Medium severity · published Sep 28, 2026
CVE-2026-101078
deepseek-ai deepseek-harness Landlock Backend profiles.ts isolation
6.3
CVSS
0.1%
EPSS
No
On KEV
Description
A vulnerability has been found in deepseek-ai deepseek-harness up to 0.1.7-rc.2. Affected is an unknown function of the file packages/sandbox/sandbox-local/src/profiles.ts of the component Landlock Backend. Such manipulation leads to improper isolation or compartmentalization. The attack must be carried out locally. The exploit has been disclosed to the public and may be used. It is advisable to implement a patch to correct this issue. The vendor was contacted early about this disclosure but did not respond in any way.
CVSS vector
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:L
Attack vector
Local
Complexity
Low
Privileges
Low
User interaction
None
Confidentiality
Low
Integrity
Low
Availability
Low
Scope
Changed
Exploitation
Is it being used?
Exploit prediction (EPSS)0.1% · higher than 1% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
DE
deepseek-harness · deepseek-ai
0.1.7-rc.0; 0.1.7-rc.1; 0.1.7-rc.2 · source: vendor
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2026-101078
CVE.org
https://www.cve.org/CVERecord?id=CVE-2026-101078
vdb-entry
https://vuldb.com/vuln/410949
signature
https://vuldb.com/vuln/410949/cti
third-party-advisory
https://vuldb.com/cve/CVE-2026-101078
third-party-advisory
https://vuldb.com/submit/929381
exploit
https://github.com/Ruoyyy/My_vulnerable/blob/main/SECURITY-MOUNT-ESCAPE.en.md
More from deepseek-harness
6.3
CVE-2026-101102
deepseek-ai deepseek-harness Code Mode Sandbox run_code sandbox
5.5
CVE-2026-108789
deepseek-ai deepseek-harness dsh-workflow-worker-thread agent behavioral workflow
5.3
CVE-2026-108788
deepseek-ai deepseek-harness Sandbox spawn sandbox
3.3
CVE-2026-101131
deepseek-ai deepseek-harness dsh index.ts reliance on untrusted inputs in a security decision
