# DeepSeek Harness: injected orders survive context compaction

> CVE-2026-95183 carries injected instructions across a context compaction boundary in DeepSeek Harness and returns them as the session's own tasks.

- **Severity:** Medium: Real and reproducible, but needs unusual setup, user help or a narrow audience. Plan a fix.
- **Category:** Vulnerability
- **Published by:** lkloliver
- **Disclosed:** 2026-10-14
- **CVE:** CVE-2026-95183
- **Affects:** DeepSeek Harness
- **Research by:** [lkloliver](https://github.com/lkloliver)
- **Primary source:** https://gist.github.com/lkloliver/c54c0cc91e1ec4f16b538e0d8a1411b6
- **Page:** https://theinjection.dev/items/dsh-compaction-injection-persistence/

CVE-2026-95183 is indirect prompt injection in DeepSeek Harness: instructions planted in tool output are copied into the model-written compaction summary and come back as the resumed session's own pending tasks, unseen by the user.

## What happened

A researcher using the handle lkloliver published the write-up for CVE-2026-95183 on October 14, 2026, covering DeepSeek Harness (dsh), a developer preview, verified at master commit c291e796. NVD and the GitHub Advisory Database published the CVE on October 16, 2026. The write-up records no vendor contact and no fix.

## How it works

Compaction replaces the conversation history with a model-written summary that becomes the entire context of the resumed session. The summarizer is instructed to reproduce the primary request and intent word for word and to list pending jobs, while tool output carries no provenance marking that separates it from the user's own instructions. Injected directives are therefore copied into the summary and inherited as established tasks.

## Who is affected

DeepSeek Harness is affected in the @deepseek-ai/dsh-compaction-basic package, at the master commit the researcher tested. Any content the agent reads can carry the payload, including web pages, email, repository files and supplier documents.

## What to do

Read a compacted summary before resuming a long session, because the user is not shown what the checkpoint contains. The write-up notes that the file sandbox detects writes outside the workspace while network egress from a resumed session is unrestricted, so limiting outbound traffic narrows the exfiltration path.

## Quick facts

- **Affected:** DeepSeek Harness (dsh) developer preview, master commit c291e796
- **Component:** @deepseek-ai/dsh-compaction-basic, summarizer.ts
- **CVE:** CVE-2026-95183, published October 16, 2026, no CVSS score published
- **Found by:** lkloliver
- **Status:** No vendor response or fix recorded in the write-up
- **Result:** The payload was preserved in three summary sections; the resumed model declined to run it in the tested configuration

## Sources

1. [Researcher Write-Up](https://gist.github.com/lkloliver/c54c0cc91e1ec4f16b538e0d8a1411b6)
2. [GitHub Advisory](https://github.com/advisories/GHSA-8rmg-g7v9-j8x6)
3. [Proof Of Concept](https://github.com/lkloliver/poc/tree/main/CVE-2026-95183)