DeepSeek V3.2 has a Cross Site Scripting (XSS) vulnerability, which allows JavaScript execution through model-generated SVG content.
Date: 2025-12
Affected: deepseek/deepseek
Attack vector: xss
Category: vulnerability-disclosure
Severity: Medium
CVE: CVE-2025-63872
CWE: CWE-79
CVSS: 6.1 (CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N)

DeepSeek V3.2 has a Cross Site Scripting (XSS) vulnerability, which allows JavaScript execution through model-generated SVG content.


Mitigations:

Architectural layers (MAESTRO):