Link Following Vulnerability in Vercel Deepsec Product
CVE-2026-109375

4.9MEDIUM

Key Information:

Vendor

Vercel
Status
Deepsec
Vendor
CVE Published:
12 October 2026

What is CVE-2026-109375?

Vercel Deepsec prior to version 1.1.17 is susceptible to a link following vulnerability in the extractTarballLocally function. This flaw allows malicious code running within a sandbox to create symbolic or hard links within result tarballs, leading to the potential for arbitrary file writing on the host orchestrator. An attacker proficient in manipulating sandboxed code can leverage this vulnerability to compromise data integrity by planting malicious links in allowed directories.

Affected Version(s)

deepsec 0.1.0 < 1.1.17

deepsec 1.1.17

References

https://github.com/vercel-labs/deepsec/pull/46
issue-trackingpatch
https://github.com/vercel-labs/deepsec/pull/47
patchissue-tracking
https://github.com/vercel-labs/deepsec/commit/c5a4e4220ec...
patch

CVSS V4

Score:
4.9
Severity:
MEDIUM
Confidentiality:
None
Integrity:
None
Availability:
None
Attack Vector:
Network
Attack Complexity:
Low
Attack Required:
Physical
Privileges Required:
Undefined
User Interaction:
Unknown

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

Yunus Aydın
.