CVE-2025-26210
03.09.2025, 14:15
DeepSeek R1 through V3.1 allows XSS, as demonstrated by JavaScript execution in the context of the run-html-chat.deepseeksvc.com domain. NOTE: some third parties have indicated that this is intended behavior.
| Vendor | Product | Version |
|---|---|---|
| deepseek | deepseek-r1 | 1.0 |
| deepseek | deepseek-v2 | - |
| deepseek | deepseek-v3 | 1.0 |
𝑥
= Vulnerable software versions