Vercel deepsec versions 0.1.0 through 1.1.16 contain a link following issue in the local tarball extraction routine. When sandboxed code generates a tar archive that includes symbolic or hard links pointing outside the intended extraction directory, the extraction process follows those links and writes files to arbitrary locations on the host running the orchestrator. This flaw enables an attacker who can supply or control the sandboxed extraction code to create or overwrite any file accessible to the orchestrator, leading to configuration changes, persistence of malicious payloads, or compromise of the underlying host.

All deployments of Vercel deepsec between 0.1.0 and 1.1.16 are affected. This includes any project or service that relies on deepsec for executing sandboxed code or processing data on Vercel’s infrastructure.

The CVSS score of 4.9 classifies the flaw as moderate severity. The EPSS score is not available, and the vulnerability is not listed in the CISA KEV catalog. Exploitation requires the attacker to control or influence the sandboxed code that generates the tarball, which may be achieved through prompt‑injected coding agents or by compromising the sandbox environment. If exploited, the attacker can write arbitrary files on the orchestrator host, potentially leading to configuration tampering or persistence of malicious artefacts.