Remote Code Execution Vulnerability in Deepseek Harness by Deepseek-AI
CVE-2026-101102

5.3MEDIUM

Key Information:

Vendor

Deepseek-ai

Status
Deepseek-harness
Vendor
CVE Published:
28 September 2026

What is CVE-2026-101102?

A remote code execution vulnerability exists in the run_code function of the Code Mode Sandbox component within Deepseek Harness. This flaw allows an attacker to manipulate the sandbox environment, which is explicitly stated by the vendor not to serve as a robust security boundary. This exposes users to potential threats, as the containment measures are inadequate for preventing malicious exploitation. Despite early notification to the vendor regarding this vulnerability, there has been no response to address the issue.

Affected Version(s)

deepseek-harness 0.1.0-rc.0

deepseek-harness 0.1.0-rc.1

deepseek-harness 0.1.0-rc.2

References

https://vuldb.com/vuln/410977
vdb-entrytechnical-description
https://vuldb.com/vuln/410977/cti
signaturepermissions-required
https://vuldb.com/cve/CVE-2026-101102
third-party-advisory

CVSS V4

Score:
5.3
Severity:
MEDIUM
Confidentiality:
Low
Integrity:
Low
Availability:
Low
Attack Vector:
Network
Attack Complexity:
Low
Attack Required:
None
Privileges Required:
Undefined
User Interaction:
None

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

rockmelodeis (VulDB User)
VulDB CNA Team
.