---
id: "CVE-2026-95183"
kind: "vulnerability"
aliases: ["CVE-2026-95183"]
title: "DeepSeek Harness: crafted content during context compaction enables prompt injection"
severity: "high"
cvss: 8.8
epss: null
exploited: false
status: "open"
category: "ai-tooling"
products: [{"name": "deepseek-harness", "fixed": [], "affected": "master commit c291e796 (2026-09) and possibly later; developer preview", "ecosystem": "vendor"}]
ecosystems: []
tags: ["ai-tooling", "deepseek-harness", "dsh", "llm-agents", "prompt-injection", "self-hosted"]
not_affected_if: ["compaction-disabled", "no-untrusted-content", "not-source-checkout", "unknown"]
published_at: "2026-10-16T15:17:37+00:00"
first_seen_at: "2026-10-23T21:57:13+00:00"
updated_at: "2026-10-23T22:36:20+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-95183", "first_seen_at": "2026-10-23T21:57:13+00:00"}, {"source": "analyst", "url": null, "first_seen_at": "2026-10-23T22:36:20+00:00"}]
---

# DeepSeek Harness: crafted content during context compaction enables prompt injection

DeepSeek Harness (dsh, developer preview) compaction is model-written: the summarizer in @deepseek-ai/dsh-compaction-basic copies instructions injected in tool output (web pages, email, repo files) verbatim into the checkpoint's Primary Request, Pending Jobs and Critical Context sections. The resumed session inherits them as its own tasks, and the user is never shown the summary. Tested on master commit c291e796 (2026-09). In the researcher's test the resumed model refused to run the injected shell command, but the payload persisted every time. Network egress is unrestricted, so silent exfiltration is the practical risk. No fix or vendor response is published.

_Summary, check and fix written by a model from the sources; labelled as such._

## Affected

- vendor:deepseek-harness affected master commit c291e796 (2026-09) and possibly later; developer preview fixed ?

## How to check

You are exposed if you run dsh from a source checkout at or after master commit c291e796 (git log) with the compaction-basic package enabled (packages/compaction/compaction-basic) and the agent reads untrusted content (web, email, repo files, tickets). Dangerous mainly where the agent has shell or network tools. Review the compaction summary before resuming a long session.

## Fix

No fixed commit or version published as of 2026-10-23. Mitigate: do not let dsh read untrusted content in long sessions, disable or avoid auto-compaction, inspect compacted summaries before resuming, restrict network egress and shell tools. Watch deepseek-ai/deepseek-harness for a fix.

## Timeline

- 2026-10-23T21:57:13+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-95183
- 2026-10-23T22:36:20+00:00 analyst — Sourced from researcher gist, GHSA entry (affected/patched 'Unknown') and theinjection.dev write-up; no vendor advisory or fix found. Public PoC repo by lkloliver (not opened). Feedly's 'patch available via GHSA' claim is false: the GHSA lists no patched version. Not exploited in the wild. CVSS 8.8 is NVD/GHSA's; the 'no user interaction' scenario in the gist differs from UI:R. Sibling: CVE-2026-95182 (same product and commit). Did not search X or HN.

## Documents

- [advisory] Researcher write-up CVE-2026-95183 (gist) https://gist.github.com/lkloliver/c54c0cc91e1ec4f16b538e0d8a1411b6
- [describes] theinjection.dev: injected orders survive context compaction https://theinjection.dev/items/dsh-compaction-injection-persistence/
- [mentions] GitHub Advisory GHSA-8rmg-g7v9-j8x6 (CVE-2026-95183) https://github.com/advisories/GHSA-8rmg-g7v9-j8x6
- [mentions] dsh compaction subsystem docs https://github.com/deepseek-ai/deepseek-harness/blob/master/docs/subsystems/compaction.md
- [poc] Researcher PoC repo for CVE-2026-95183 https://github.com/lkloliver/poc/tree/main/CVE-2026-95183

## From the sources

An issue in the context-compaction feature of DeepSeek Harness (dsh) commit c291e796 allows attackers to execute a prompt injection attack via crafted external content.

---

_Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai_