CVE-2025-26210
Published: 03 September 2025
Summary
CVE-2025-26210 is a high-severity Cross-site Scripting (CWE-79) vulnerability in Deepseek Deepseek-R1. Its CVSS base score is 8.8 (High).
Operationally, exploitation aligns with the MITRE ATT&CK technique Exploit Public-Facing Application (T1190); ranked at the 31.5th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog; a public proof-of-concept is referenced.
This vulnerability is AI-related — categorised as Enterprise AI Assistants; in the LLM/Generative AI Risks risk domain.
The strongest mitigations our analysis identified are NIST 800-53 SC-18 (Mobile Code) and SI-10 (Information Input Validation).
Threat & Defense at a Glance
Threat & Defense Details
Mitigating Controls (NIST 800-53 r5)AI
SI-10 enforces validation and sanitization of user inputs to block malicious JavaScript payloads that enable XSS execution in the DeepSeek chat domain.
SI-15 requires output filtering and encoding to prevent injected JavaScript from executing in the victim's browser context as demonstrated in this CVE.
SC-18 restricts mobile code technologies like JavaScript, directly countering arbitrary script execution within the run-html-chat.deepseeksvc.com domain.
MITRE ATT&CK Enterprise TechniquesAI
Why these techniques?
XSS enables exploitation of public-facing web app (T1190), client-side execution via JS (T1203, T1059.007), discovery of system/browser info (T1082, T1217), theft of web session cookies and browser credentials (T1539, T1555.003), and exfiltration to external web services via fetch.
NVD Description
DeepSeek R1 through V3.1 allows XSS, as demonstrated by JavaScript execution in the context of the run-html-chat.deepseeksvc.com domain. NOTE: some third parties have indicated that this is intended behavior.
Deeper analysisAI
CVE-2025-26210 is a cross-site scripting (XSS) vulnerability affecting DeepSeek R1 through V3.1. It enables JavaScript execution within the context of the run-html-chat.deepseeksvc.com domain, as demonstrated in public reports. The issue is classified under CWE-79 and carries a CVSS v3.1 base score of 8.8 (AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H), indicating high severity due to its network accessibility, low attack complexity, lack of required privileges, and significant impacts on confidentiality, integrity, and availability.
The vulnerability can be exploited by any network-accessible attacker with no authentication required, though it relies on user interaction such as clicking a malicious link or input. Successful exploitation allows arbitrary JavaScript execution in the victim's browser under the deepseeksvc.com domain context, potentially leading to session hijacking, data theft, account takeover, or further malicious actions within the affected service.
References include the official DeepSeek site (https://deepseek.com), a detailed HackMD post (https://hackmd.io/@MrqrFIlhQFi7vUwkqbrXDw/deepseek), and a YouTube demonstration (https://youtu.be/IgQwy52FVT4). Some third parties have noted that the behavior may be intended, with no specific patches or mitigations detailed in the available information.
Details
- CWE(s)
Affected Products
AI Security AnalysisAI
- AI Category
- Enterprise AI Assistants
- Risk Domain
- LLM/Generative AI Risks
- OWASP Top 10 for LLMs 2025
- None mapped
- Classification Reason
- DeepSeek is an AI chat platform (chat.deepseek.com) providing LLM-based code generation and execution features, fitting enterprise AI assistants; vulnerability exploits AI-generated insecure HTML/JS leading to XSS in the platform's runtime context.