DeepSeek Harness accepts user input in the createContext function of sandbox.ts. The input is incorrectly validated, allowing a crafted payload to escape the intended sandbox environment. Once outside the sandbox an attacker can execute arbitrary code or otherwise compromise the application. The weakness aligns with least privilege violations (CWE‑264) and improper access control (CWE‑265).

The flaw appears in DeepSeek Harness for all releases up to and including 0.1.0‑rc.5. Users running any of these versions should verify their deployment version and compare it to the latest release list from the vendor.

The CVSS score of 5.3 classifies the issue as moderate severity. EPSS data is not available, and the vulnerability is not listed in the CISA KEV catalog, suggesting no known widespread exploitation yet. Nevertheless, the description indicates that the attack can be launched remotely, implying the attacker does not need local access. If the vendor does not provide a fix, a potential attack path is to supply malicious context data that bypasses the sandbox, leading to code execution on the host.