{"id":"CVE-2026-95183","kind":"vulnerability","aliases":["CVE-2026-95183"],"related":[],"title":"DeepSeek Harness: crafted content during context compaction enables prompt injection","description":"An issue in the context-compaction feature of DeepSeek Harness (dsh) commit c291e796 allows attackers to execute a prompt injection attack via crafted external content.","summary":"DeepSeek Harness (dsh, developer preview) compaction is model-written: the summarizer in @deepseek-ai/dsh-compaction-basic copies instructions injected in tool output (web pages, email, repo files) verbatim into the checkpoint's Primary Request, Pending Jobs and Critical Context sections. The resumed session inherits them as its own tasks, and the user is never shown the summary. Tested on master commit c291e796 (2026-09). In the researcher's test the resumed model refused to run the injected shell command, but the payload persisted every time. Network egress is unrestricted, so silent exfiltration is the practical risk. No fix or vendor response is published.","severity":"high","cvss":8.8,"epss":null,"exploited":false,"exploited_at":null,"products":[{"name":"deepseek-harness","fixed":[],"affected":"master commit c291e796 (2026-09) and possibly later; developer preview","ecosystem":"vendor"}],"ecosystems":[],"tags":["ai-tooling","deepseek-harness","dsh","llm-agents","prompt-injection","self-hosted"],"not_affected_if":["compaction-disabled","no-untrusted-content","not-source-checkout","unknown"],"how_to_check":"You are exposed if you run dsh from a source checkout at or after master commit c291e796 (git log) with the compaction-basic package enabled (packages/compaction/compaction-basic) and the agent reads untrusted content (web, email, repo files, tickets). Dangerous mainly where the agent has shell or network tools. Review the compaction summary before resuming a long session.","fix":"No fixed commit or version published as of 2026-10-23. Mitigate: do not let dsh read untrusted content in long sessions, disable or avoid auto-compaction, inspect compacted summaries before resuming, restrict network egress and shell tools. Watch deepseek-ai/deepseek-harness for a fix.","status":"open","published_at":"2026-10-16T15:17:37+00:00","first_seen_at":"2026-10-23T21:57:13+00:00","triaged_at":"2026-10-23T22:34:47+00:00","updated_at":"2026-10-23T22:36:20+00:00","category":"ai-tooling","confidence":0.75,"triage":{"at":"2026-10-23T22:34:47Z","model":"claude-haiku-5-5","output":{"fix":"unknown","reach":"unknown","title":"DeepSeek Harness: crafted content during context compaction enables prompt injection","impact":"high","summary":"DeepSeek Harness (dsh), an agent tool, has a flaw in its context-compaction feature at commit c291e796. An attacker who supplies crafted external content can inject prompts that steer the agent's actions.","category":"ai-tooling","who_cares":["deepseek-harness","dsh","llm-agents"],"confidence":0.5,"needs_auth":"unknown","worst_case":"attacker steers the agent via injected prompts from external content","analyst_note":"Check the NVD entry and the dsh repository for the affected version range, a fixed commit, and whether the agent has tool access that makes the injection dangerous.","how_to_check":"unknown","needs_analyst":true,"not_affected_if":["unknown"],"user_interaction":"unknown","needs_special_setup":"unknown","severity_if_unknown":"high"},"cost_usd":0.000458,"input_tokens":2874,"output_tokens":341,"severity_before":"high"},"analyst_status":"done","analyst_note":"Check the NVD entry and the dsh repository for the affected version range, a fixed commit, and whether the agent has tool access that makes the injection dangerous.","search":"'-09':100B '-2026':12A,15A '-95183':13A,16A '/dsh-compaction-basic':52B '2026':99B 'agent':29B 'ai':21B,51B 'ai-tool':20B 'allow':154C 'attack':155C,161C 'c291e796':98B,153C 'checkpoint':67B 'command':115B 'commit':97B,152C 'compact':7A,41B,146C 'content':4A,165C 'context':6A,75B,145C 'context-compact':144C 'copi':53B 'craft':3A,163C 'critic':74B 'cve':11A,14A 'deepseek':1A,18A,24B,36B,50B,149C 'deepseek-ai':49B 'deepseek-har':23B 'deepseek-harness':17A 'develop':39B 'dsh':26B,38B,151C 'egress':123B 'email':61B 'enabl':8A 'everi':120B 'execut':157C 'exfiltr':128B 'extern':164C 'featur':147C 'file':63B 'fix':134B 'har':2A,25B,37B,150C 'harness':19A 'host':35B 'inherit':80B 'inject':10A,32B,55B,113B,160C 'instruct':54B 'issu':141C 'job':72B 'llm':28B 'llm-agent':27B 'master':96B 'model':44B,108B 'model-written':43B 'network':122B 'never':90B 'output':58B 'page':60B 'payload':118B 'pend':71B 'persist':119B 'practic':131B 'preview':40B 'primari':69B 'prompt':9A,31B,159C 'prompt-inject':30B 'publish':139B 'refus':109B 'repo':62B 'request':70B 'research':103B 'respons':137B 'resum':78B,107B 'risk':132B 'run':111B 'section':76B 'self':34B 'self-host':33B 'session':79B 'shell':114B 'shown':91B 'silent':127B 'summar':47B 'summari':93B 'task':85B 'test':94B,105B 'time':121B 'tool':22B,57B 'unrestrict':125B 'user':88B 'vendor':136B 'verbatim':64B 'via':162C 'web':59B 'written':45B","nicknames":[],"mitigations":[],"who_affected":null,"tier":null,"verified":{},"analyst_revisit_at":null,"first_public_at":"2026-10-16T15:17:37+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","cvss_by":"134c704f-9b21-4f2e-91b3-4a467353bcc0","poc_count":1,"sources":[{"source":"nvd","external_id":"CVE-2026-95183","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-95183","severity":null,"published_at":"2026-10-16T15:17:37+00:00","modified_at":"2026-10-21T02:17:07+00:00","first_seen_at":"2026-10-23T21:57:13+00:00","fetched_at":"2026-10-23T22:28:55+00:00","note":null},{"source":"analyst","external_id":"CVE-2026-95183:257","url":null,"severity":null,"published_at":"2026-10-23T22:36:20+00:00","modified_at":"2026-10-23T22:36:20+00:00","first_seen_at":"2026-10-23T22:36:20+00:00","fetched_at":"2026-10-23T22:36:20+00:00","note":"Sourced from researcher gist, GHSA entry (affected/patched 'Unknown') and theinjection.dev write-up; no vendor advisory or fix found. Public PoC repo by lkloliver (not opened). Feedly's 'patch available via GHSA' claim is false: the GHSA lists no patched version. Not exploited in the wild. CVSS 8.8 is NVD/GHSA's; the 'no user interaction' scenario in the gist differs from UI:R. Sibling: CVE-2026-95182 (same product and commit). Did not search X or HN."}],"documents":[{"id":1533,"url":"https://gist.github.com/lkloliver/c54c0cc91e1ec4f16b538e0d8a1411b6","title":"Researcher write-up CVE-2026-95183 (gist)","kind":"advisory","source":"analyst","text":null,"published_at":null,"relation":"advisory","confidence":null,"note":null},{"id":1534,"url":"https://github.com/lkloliver/poc/tree/main/CVE-2026-95183","title":"Researcher PoC repo for CVE-2026-95183","kind":"poc","source":"analyst","text":null,"published_at":null,"relation":"poc","confidence":null,"note":null},{"id":1528,"url":"https://github.com/advisories/GHSA-8rmg-g7v9-j8x6","title":"GitHub Advisory GHSA-8rmg-g7v9-j8x6 (CVE-2026-95183)","kind":"advisory","source":"analyst","text":null,"published_at":null,"relation":"mentions","confidence":null,"note":null},{"id":1529,"url":"https://theinjection.dev/items/dsh-compaction-injection-persistence/","title":"theinjection.dev: injected orders survive context compaction","kind":"blog","source":"analyst","text":null,"published_at":null,"relation":"describes","confidence":null,"note":null},{"id":1531,"url":"https://github.com/deepseek-ai/deepseek-harness/blob/master/docs/subsystems/compaction.md","title":"dsh compaction subsystem docs","kind":"other","source":"analyst","text":null,"published_at":null,"relation":"mentions","confidence":null,"note":null}],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}