CVE-2025-63872 Details
Description
DeepSeek V3.2 has a Cross Site Scripting (XSS) vulnerability, which allows JavaScript execution through model-generated SVG content.
A cross-site scripting (XSS) vulnerability has been identified in DeepSeek Chat version 3.2. This issue arises from the web interface's improper handling of model-generated SVG content, which can execute arbitrary JavaScript in the user's browser. The vulnerability allows for the execution of JavaScript through crafted messages that exploit the active nature of SVG in modern browsers.
Users are advised to avoid loading untrusted SVG content in DeepSeek Chat, use non-web clients when possible, and log out after sessions. For the vendor, it is recommended to sanitize SVG input with libraries like DOMPurify, strip event attributes and scriptable SVG elements, apply a strict Content Security Policy, and consider rasterizing SVG server-side or sandboxing rendering environments.
Metrics
CVSS 4.0 Severity and Vector Strings:
No CVSS 4.0 data is available for this CVE.
CVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
CISA-ADP
Assessed Dec 2, 2025References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://medium.com/@vinitkundu14/cve-2025-63872-svg-based-xss-in-deepseek-chat-v3-2-db4ebc1f1f28 | [email protected] | ExploitThird Party Advisory |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-79 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') | CISA-ADP |
Affected Products
| Product | Versions |
|---|---|
| deepseek deepseek | 3.2 |
CPE
Remediation
| |
Change History
5 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Jun 17, 2026 | CVE Modified | [email protected] |
| Jun 17, 2026 | CVE Modified | CISA-ADP |
| Jan 14, 2026 | Initial Analysis | [email protected] |
| Dec 2, 2025 | CVE Modified | CISA-ADP |
| Dec 2, 2025 | New CVE Received | [email protected] |