DeepSeek Harness: injected orders survive context compaction
CVE-2026-95183 carries injected instructions across a context compaction boundary in DeepSeek Harness and returns them as the session's own tasks.
· lkloliver · Research by lkloliver
CVE-2026-95183 is indirect prompt injection in DeepSeek Harness: instructions planted in tool output are copied into the model-written compaction summary and come back as the resumed session's own pending tasks, unseen by the user.
01What happened
A researcher using the handle lkloliver published the write-up for CVE-2026-95183 on October 14, 2026, covering DeepSeek Harness (dsh), a developer preview, verified at master commit c291e796. NVD and the GitHub Advisory Database published the CVE on October 16, 2026. The write-up records no vendor contact and no fix.
02How it works
Compaction replaces the conversation history with a model-written summary that becomes the entire context of the resumed session. The summarizer is instructed to reproduce the primary request and intent word for word and to list pending jobs, while tool output carries no provenance marking that separates it from the user's own instructions. Injected directives are therefore copied into the summary and inherited as established tasks.
03Who is affected
DeepSeek Harness is affected in the @deepseek-ai/dsh-compaction-basic package, at the master commit the researcher tested. Any content the agent reads can carry the payload, including web pages, email, repository files and supplier documents.
04What to do
Read a compacted summary before resuming a long session, because the user is not shown what the checkpoint contains. The write-up notes that the file sandbox detects writes outside the workspace while network egress from a resumed session is unrestricted, so limiting outbound traffic narrows the exfiltration path.
Sources 3 links, all fetched
- 1gist.github.comResearcher Write-Up
- 2github.comGitHub Advisory
- 3github.comProof Of Concept