DeepSeek Cross-Site Scripting Vulnerability

A Cross-Site Scripting (XSS) vulnerability has been identified in DeepSeek versions R1 through V3.1. This vulnerability allows remote attackers to execute arbitrary code by injecting malicious payloads into unspecified input fields. The issue arises from insecure handling of user-generated content, which can be exploited to execute harmful JavaScript in the victim's browser.

Impact

Exploitation of this vulnerability allows for Cross-Site Scripting, where an attacker can execute scripts in the context of the user's session.

Reproduction

The vulnerability can be reproduced by uploading a file or requesting the AI to generate a program that includes a payload, such as JavaScript code. This injected code can then be executed, demonstrating the XSS vulnerability.