Is CVE-2026-116367 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-116367 being exploited in the wild.

How severe is CVE-2026-116367?

Medium severity, with a CVSS score of 6.3, published 26 October 2026.

Which products and versions are affected?

DeepSeek Harness up to 0.1.0-rc.5.

Is there a fix for CVE-2026-116367?

No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

How is CVE-2026-116367 attacked?

It is attacked over the network, in a software library.

Am I affected by CVE-2026-116367?

Check whether you run DeepSeek Harness at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-116367: DeepSeek Harness sandbox issue in createContext

CVE-2026-116367 · Severity: medium · CVSS 6.3 · Published 2026-10-26

DeepSeek Harness is a development framework that runs code in isolated sandbox environments. A vulnerability in its context creation function allows attackers to break out of the sandbox and execute code outside the intended isolation boundary, potentially compromising the host system.

Technologies: DeepSeek Harness. Vendors: DeepSeek.

Quick answers

Is CVE-2026-116367 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-116367 being exploited in the wild.
How severe is CVE-2026-116367?: Medium severity, with a CVSS score of 6.3, published 26 October 2026.
Which products and versions are affected?: DeepSeek Harness up to 0.1.0-rc.5.
Is there a fix for CVE-2026-116367?: No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.
How is CVE-2026-116367 attacked?: It is attacked over the network, in a software library.
Am I affected by CVE-2026-116367?: Check whether you run DeepSeek Harness at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

The vulnerability exists in the createContext function of the cordis-host-runner component (packages/extensions/cordis-host-runner/src/sandbox.ts) and results in a sandbox escape. The attack is remotely exploitable and does not require authentication or user interaction, allowing an attacker to break sandbox isolation and gain execution on the host system.

Affected products

DeepSeek Harness up to 0.1.0-rc.5

Timeline

2026-10-26: disclosed

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.