Cross-Site Scripting Vulnerability in DeepSeek R1 to V3.1
CVE-2025-26210

8.8HIGH

Key Information:

Vendor

DeepSeek

Status
DeepSeek R1
Vendor
CVE Published:
3 September 2025

What is CVE-2025-26210?

A Cross-Site Scripting (XSS) vulnerability exists in versions of DeepSeek from R1 to V3.1, which enables attackers to execute arbitrary code through certain input fields. This vulnerability exposes users to various security risks, as an attacker can inject malicious scripts that may compromise the integrity of user sessions and data.

References

https://hackmd.io/@MrqrFIlhQFi7vUwkqbrXDw/deepseek
https://youtu.be/IgQwy52FVT4
https://deepseek.com

CVSS V3.1

Score:
8.8
Severity:
HIGH
Confidentiality:
High
Integrity:
High
Availability:
High
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
None
User Interaction:
Required
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.