https://db.gcve.eu/rss/recent/all/10 Most recent entries from all 2026-10-15T02:47:25.111349+00:00 Vulnerability-Lookup info@gcve.eu python-feedgen Contains only the most 10 recent entries. https://db.gcve.eu/vuln/cve-2026-109375 CVE-2026-109375 — Vercel deepsec before 1.1.17 Arbitrary File Write via Symlink in Sandbox Tarball Extraction 2026-10-15T02:47:25.112432+00:00

Affected: Vercel deepsec

Vercel deepsec from 0.1.0 before 1.1.17 contains a link following vulnerability in extractTarballLocally that allows sandboxed code to write files outside the sandbox by planting links in result tarballs. Attackers controlling sandbox code, such as a prompt-injected coding agent, can plant symbolic or hard links in the host data directory to write arbitrary files on the orchestrator host.