Sandbox Vulnerability in Deepseek-AI Deepseek-Harness Affects Multiple Versions
CVE-2026-108788

4.8MEDIUM

Key Information:

Vendor: Deepseek-ai
Status: Deepseek-harness
Vendor: CVE Published:; 12 October 2026

🔔 Create Deepseek-ai Vulnerability Alert

Badges

👾 Exploit Exists🟡 Public PoC

What is CVE-2026-108788?

A vulnerability has been identified in Deepseek-AI's Deepseek-Harness up to version 0.1.1-rc.2. This issue resides within the 'spawn' function of the Sandbox component, where manipulation of the Profile argument could lead to potential sandbox escapes. Given that this flaw permits attacks on localhost, it poses a serious risk to users operating vulnerable versions. The exploit details have been made public, and despite attempts to notify the vendor, there has been no response to address the issue effectively.

Affected Version(s)

deepseek-harness 0.1.1-rc.0

deepseek-harness 0.1.1-rc.1

deepseek-harness 0.1.1-rc.2

Exploit Proof of Concept (PoC)

PoC code is written by security researchers to demonstrate the vulnerability can be exploited. PoC code is also a key component for weaponization which could lead to ransomware.

CVE-2026-108788 - Proof of Concept