CVE-2026-109375EPSS p23.7%

CVE-2026-109375CVE-2026-109375

Description

Vercel deepsec from 0.1.0 before 1.1.17 contains a link following vulnerability in extractTarballLocally that allows sandboxed code to write files outside the sandbox by planting links in result tarballs. Attackers controlling sandbox code, such as a prompt-injected coding agent, can plant symbolic or hard links in the host data directory to write arbitrary files on the orchestrator host.

Scoring

CVSS 6.1 ()
VectorCVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:N/I:H/A:N
EPSS0.32% probability of exploitation · percentile 23.7% · 2026-10-17T12:00:28Z
Last modified2026-10-16
Sourced from NVD + FIRST.org EPSS. Curated for EU compliance use cases by Adam Lundqvist, Founder at SQUR.