Prompt injection flaw reported in DeepSeek Harness compaction

A prompt injection vulnerability has been reported in DeepSeek Harness, the tool also known as dsh, and tracked as CVE-2026-95183. The entry was published to the US National Vulnerability Database on 16 October 2026. According to the NVD record, an issue in the context-compaction feature of DeepSeek Harness at commit c291e796 "allows attackers to execute a prompt injection attack via crafted external content".

That is the whole of the published technical description. The record does not say how many users are affected, whether the flaw has been exploited, or whether a fix exists. The listed references are DeepSeek's website and a public gist that appears to hold the researcher's write-up. No vendor advisory is cited in the record, and the entry does not state that DeepSeek has acknowledged the report.

Prompt injection is an attack in which text that a model reads as data is treated instead as instructions. For an agent that fetches web pages, files or tool output, this means content written by an attacker can change what the agent does next. Context compaction is the step where an agent summarises or shortens its own accumulated history so it fits back into a limited context window. The NVD description places the problem in that step, which implies the compaction process handles content that originated outside the user's own instructions.

The severity of the issue is recorded as moderate in our tracking, and the status as reported rather than fixed. The NVD entry pins the problem to a specific commit, c291e796, rather than to a numbered release. Users who want to check their exposure will need to compare the commit their installation was built from against that identifier, because no affected version range is given in the published record.

We have not seen a patch note, changelog entry or security advisory from DeepSeek for this CVE among the listed references. The company's website is cited only as a general reference. It is not clear from the record whether the report was made to the vendor before publication.

For anyone running dsh in a workflow that pulls in untrusted material, such as scraped pages, issue trackers or shared documents, the practical reading is that the summarisation stage should be treated as attacker-reachable until the vendor says otherwise. That means limiting the tools and credentials the agent can reach, and not assuming that content already inside the context window is safe because it was condensed.

The Agentic Times has not independently verified the report. We will update this piece if DeepSeek publishes a fix or an advisory.