4.9 Moyenne

CVE-2026-109375 Vercel deepsec from 0.1.0 before 1.1.17 contains a link following vulnerability in extractTarballLocally that allows…

Description

Vercel deepsec from 0.1.0 before 1.1.17 contains a link following vulnerability in extractTarballLocally that allows sandboxed code to write files outside the sandbox by planting links in result tarballs. Attackers controlling sandbox code, such as a prompt-injected coding agent, can plant symbolic or hard links in the host data directory to write arbitrary files on the orchestrator host.

Produits et versions touchés

Produit	Versions touchées	Corrigé en
deepsec 1.1	premières → < 1.1.17	1.1.17
deepsec 0.1	0.1.0 → < 1.1.17	1.1.17

Références

GitHub Pull Request #46 github.com
GitHub Pull Request #47 github.com
Patch Commit github.com
github.com github.com
VulnCheck Advisory: Vercel deepsec before 1.1.17 Arbitrary File Write via Symlink in Sandbox Tarball Extraction www.vulncheck.com

Chronologie

Publiée 12 octobre 2026
Dernière modification 13 octobre 2026

Suivre cette CVE