A flaw in the spawn function of the Sandbox component in deepseek-harness allows an attacker to craft a malicious Profile argument that bypasses the intended sandbox restrictions. By manipulating this argument, an adversary could execute arbitrary code or elevate privileges on the local host. The weakness involves improper privilege separation and failure to enforce least‑privilege controls, reflected in CWE‑264 and CWE‑265.

The vulnerability exists in deepseek-ai deepseek-harness versions up to and including 0.1.1‑rc.2. Systems running any of these releases are affected and should be examined for whether they deploy the vulnerable component locally.

The vulnerability has a CVSS score of 4.8, indicating moderate severity. EPSS data is not available and the issue is not listed in CISA’s KEV catalog, but the flaw is publicly disclosed and can be exploited on a local machine. Because it requires local access and no network attack vector is documented, the risk focus is on users with local/logged‑in access or services that run deepseek-harness without sufficient isolation.