CVE-2026-109375

6.1Medium

Published 12 Oct 2026 · NVD status: Deferred · AI triage by gemini-3.8-flash

6.1Medium

Attack vector: Network
Complexity: High
Privileges needed: None
User interaction: Required
Impact: High impact on integrity
Weakness: CWE-59

Impact

Attackers executing code inside the sandbox can write arbitrary files to the orchestrator host. They need to control execution inside the sandbox, such as via prompt injection against a coding agent.

Root cause

The extractTarballLocally function extracts tarballs without validating symbolic or hard links, allowing directory traversal and writes outside the target directory.

Affected systems

Vercel deepsec from 0.1.0 before 1.1.17

CVSS v3.1 · CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:N/I:H/A:N

Fix & remediation

Upgrade deepsec to version 1.1.17 or later. If upgrading immediately is not possible, disable local tarball extraction or do not process tarballs generated by untrusted sandbox code.

shell

$ npm install deepsec@^1.1.17

AI-suggested. Run it in staging first and check it against the vendor advisory. Why?

Ad · In-content banner

NVD description

Vercel deepsec from 0.1.0 before 1.1.17 contains a link following vulnerability in extractTarballLocally that allows sandboxed code to write files outside the sandbox by planting links in result tarballs. Attackers controlling sandbox code, such as a prompt-injected coding agent, can plant symbolic or hard links in the host data directory to write arbitrary files on the orchestrator host.

References

Source: nvd.nist.gov/vuln/detail/CVE-2026-109375