What happened
Published 2026-10-12 (CVSS 6.1 v3.1 scope-changed, CWE-59) by VulnCheck. A link-following flaw in extractTarballLocally allows sandboxed code to write files outside the sandbox by planting links in result tarballs. Verified via NVD REST API.
Why it matters
Another sandbox-boundary flaw in the exact layer defenders rely on to contain prompt-injected agents — Vercel is a widely used platform, and its deepsec sandbox is a security boundary; a link-following write primitive undermines isolation and enables host file tamper from sandboxed code.
Attack vector
Attacker-controlled sandbox code plants symbolic/hard links inside result tarballs; extractTarballLocally follows the links on extraction to write files outside the sandbox on the orchestrator host.
Affected systems
Vercel deepsec 0.1.0 – before 1.1.17 (npm sandbox for AI/agent code execution)
Mitigation
Upgrade deepsec to >= 1.1.17 (fix: commit c5a4e422, PRs #46/#47).