CVE-2025-63872 Overview
CVE-2025-63872 is a Cross-Site Scripting (XSS) vulnerability in DeepSeek V3.2 that allows JavaScript execution through model-generated Scalable Vector Graphics (SVG) content. An attacker can craft prompts that instruct the model to return SVG markup containing embedded scripts. When the DeepSeek chat interface renders the response, the browser executes the attacker-controlled JavaScript in the context of the victim's session.
The issue is tracked under CWE-79 and requires user interaction to trigger. Exploitation can lead to session token theft, unauthorized actions on behalf of the user, and phishing content injected into an otherwise trusted interface.
Critical Impact
Successful exploitation enables arbitrary JavaScript execution in the DeepSeek chat context, exposing session data and enabling client-side attacks against authenticated users.
Affected Products
- DeepSeek Chat V3.2
- DeepSeek web-based chat interface rendering model output as HTML/SVG
- Deployments that render untrusted model output without sanitization
Discovery Timeline
- 2025-12-02 - CVE-2025-63872 published to the National Vulnerability Database (NVD)
- 2026-06-17 - Last updated in NVD database
Technical Details for CVE-2025-63872
Vulnerability Analysis
The vulnerability resides in how the DeepSeek V3.2 chat frontend renders model-generated content. Large language model (LLM) responses can include SVG markup, which the interface renders inline rather than treating as untrusted data. SVG supports <script> elements and JavaScript event handlers such as onload, giving attackers a direct execution path once the SVG is parsed by the browser.
An attacker crafts a prompt, or plants prompt-injection content in a shared conversation or referenced document, that steers the model into producing SVG containing script payloads. When a victim views the response, the payload executes with the origin of the DeepSeek chat application. This turns model output into a client-side code delivery channel.
Root Cause
The root cause is missing output sanitization on model-generated HTML and SVG content. The application trusts the model as a content producer and passes its output into the Document Object Model (DOM) without stripping active content. Because SVG is treated as safe imagery by many rendering libraries, script-bearing elements and event handlers survive to execution.
Attack Vector
The attack vector is network-based and requires user interaction. An attacker delivers a malicious prompt directly, or indirectly through content the model is asked to summarize or process. The victim renders the response inside the DeepSeek chat interface, at which point the SVG payload runs. The scope is changed because code executes in the browser origin of the chat application, affecting resources beyond the vulnerable component.
No verified public exploit code is available. Technical analysis is provided in the Medium Blog CVE-2025-63872 Analysis.
Detection Methods for CVE-2025-63872
Indicators of Compromise
- Model responses containing <svg> elements with embedded <script> tags or on* event handlers such as onload, onerror, or onmouseover.
- Outbound requests from the DeepSeek chat origin to unfamiliar domains shortly after a chat session.
- Chat transcripts referencing prompt injection payloads instructing the model to emit SVG or HTML markup.
- Unexpected session cookie access or token exfiltration from browsers actively using DeepSeek.
Detection Strategies
- Inspect stored chat transcripts and logs for SVG payloads containing script tags or JavaScript URI schemes such as javascript:.
- Deploy Content Security Policy (CSP) reporting to surface inline script execution attempts within the chat origin.
- Use browser-side telemetry or endpoint detection to correlate script execution with LLM response rendering.
Monitoring Recommendations
- Log and review model outputs that include <svg>, <foreignObject>, or event handler attributes before rendering.
- Alert on anomalous cross-origin fetches, document.cookie access patterns, and DOM sink writes originating from the chat page.
- Monitor user reports of unexpected redirects, prompts, or authentication requests inside DeepSeek chat sessions.
How to Mitigate CVE-2025-63872
Immediate Actions Required
- Apply any DeepSeek-issued update for V3.2 chat rendering as soon as it is available.
- Restrict use of DeepSeek V3.2 in browsers that are also authenticated to sensitive corporate resources.
- Educate users to avoid pasting untrusted content into DeepSeek prompts that could carry prompt-injection payloads.
Patch Information
No vendor advisory URL is listed in the NVD entry at the time of publication. Consult the Medium Blog CVE-2025-63872 Analysis and DeepSeek's official channels for remediation status. Operators of self-hosted deployments should sanitize model output server-side and client-side before rendering.
Workarounds
- Enforce a strict Content Security Policy that disallows inline scripts and restricts script sources on the chat origin.
- Sanitize model output with a library such as DOMPurify configured to strip <script> elements, event handler attributes, and dangerous SVG constructs.
- Render model-generated SVG inside a sandboxed <iframe> with sandbox="allow-same-origin" removed to prevent script execution.
- Disable inline SVG rendering entirely and display SVG only as static images fetched via <img> tags.
# Example Content Security Policy header limiting script execution
Content-Security-Policy: default-src 'self'; script-src 'self'; object-src 'none'; base-uri 'self'; frame-ancestors 'none'
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
