MediumVulnerabilityLLM-specific
CVE-2026-95183: DeepSeek Harness context-compaction prompt injection via external content
- Source
- NVD(opens in a new tab)
- Identifier
- CVE-2026-95183
- Published
- Record updated
- Known exploitation
- Not listed in the CISA Known Exploited Vulnerabilities catalog at the last check.
Summary
An issue in the context-compaction feature of DeepSeek Harness (dsh) commit c291e796 allows attackers to execute a prompt injection attack via crafted external content. The source text does not state the attacker's resulting gain or any precondition beyond supplying that external content.
Mitigation
The source does not state a fix yet. Check the original advisory for updates.
Related items
- LowTypeSafe’s Jev ‘even more susceptible to attack’ than LLMs, says security vendorSimilar attack · CSO Online
- HighCVE-2026-76066: IntentKit authorization bypass lets callers execute owner-restricted toolsSimilar attack · NVD/CVE Database
- LowJev as a judge: How counterfeit policy steers JevSimilar attack · Datadog Security Labs
- LowAgents at the Edge: Extending AI Security Governance to Physical AI with DefenseClawSimilar attack · Cisco AI Blog
- InfoMMA-SafetyBench: A Benchmark for Multimodal Agent Safety EvaluationSimilar attack · Arxiv (cs.CR + cs.CL + cs.LG)