Finding / deepseek-harness
2026-10-13-deepseek-harness-cve-2026-101078-publishes-a-local-linux-isolation-allegation-without-an-established-curren
CVE-2026-101078 publishes a local Linux isolation allegation without an established current fix. A CVE/GHSA record was published alleging local Linux sandbox isolation failure through 0.1.7-rc.2. Its referenced report alleges that root-run confined commands can retain mount capability and reach host filesystems. This is an attributed report, not a demonstrated escape, and not an ordinary unprivileged desktop claim. No current affected/fixed status is established.
Channel: docs-only; advisory describes prereleases through 0.1.7-rc.2. Half: defect. Date: 2026-09-28T15:30:18Z (CVE); GHSA at 18:31:24Z.
Operator consequence: Root-run Linux evaluations need a backend-capability review before relying on this boundary. Obtain a reproducible backend-specific test and a fixing commit/containing tag to settle the allegation. Do not label the older PID-namespace fix as this CVE’s fix.
Receipt
Finding metadata
Run: 2026-10-13-profile-refresh-2026-09-21_2026-10-13-frontier-v0
Finding ID: 2026-10-13-deepseek-harness-cve-2026-101078-publishes-a-local-linux-isolation-allegation-without-an-established-curren
Profile citations
- deepseek-harness / claim / cve-linux-isolation-publication
Source links
Primary links, including exact changelog lines when available.
- commit pinned cve record2026-10-13-deepseek-harness-cve-2026-101078-publishes-a-local-linux-isolation-allegation-without-an-established-currenCVEProject/cvelistV5 / cves/2026/101xxx/CVE-2026-101078.jsoncanonical advisory2026-10-13-deepseek-harness-cve-2026-101078-publishes-a-local-linux-isolation-allegation-without-an-established-currengithub.com/advisories/GHSA-23q9-h232-4q79tagged commit file2026-10-13-deepseek-harness-cve-2026-101078-publishes-a-local-linux-isolation-allegation-without-an-established-currenRuoyyy/My_vulnerable / SECURITY-MOUNT-ESCAPE.en.md