CVE-2026-95182: DeepSeek Harness can be tricked into running a planted fake npx

What it is

The researcher's write-up: dsh's MCP client (@deepseek-ai/dsh-mcp-client) passes the configured command name, such as npx, straight to the MCP SDK's stdio transport, and the child process inherits the host PATH.

In pnpm source-checkout setups the project's node_modules/.bin comes first on PATH, and the model can write there under the default workspace-write sandbox. Instructions hidden in a web page, email, ticket or repo can get the model to plant a same-named executable as an ordinary workspace write.

From then on, each start or reconnect of that MCP server runs the attacker's file as a long-lived process with the server's tools and secrets. The sandbox only limits file writes, not network traffic. The researcher says the same bare-name spawn exists in @deepseek-ai/dsh-sandbox-local.

A second CVE from the same researcher, CVE-2026-95183, covers dsh's context compaction: injected instructions, including full shell commands, get copied word for word into the compacted summary and carried into the resumed session as pending tasks.

How to check

1. Affected: DeepSeek Harness (dsh) developer preview, verified through commit c291e796 (September 2026) on Linux and macOS.
2. You're most exposed if you run dsh from a pnpm source checkout with MCP servers launched by bare names like npx.

How to fix

1. No fixed commit is listed yet. Watch the dsh repository for a fix.
2. Configure MCP servers with absolute paths to their executables instead of bare names.
3. Check node_modules/.bin for files you didn't install, and don't let dsh read untrusted content while it can write to the workspace.

# look for recently changed launchers the agent could have planted
ls -la --time-style=full-iso node_modules/.bin | sort -k6,7 | tail

Sources

• Researcher write-up for CVE-2026-95182 (lkloliver) ↗
• Researcher write-up for CVE-2026-95183 (lkloliver) ↗
• NVD: CVE-2026-95182 ↗
• NVD: CVE-2026-95183 ↗