⚡Critical XSS in DeepSeek AI

Hey guys! 👋 In today’s brief write-up, I’ll walk you through a critical reflected XSS vulnerability discovered in the newly launched DeepSeek AI. This bug was reported by Muhammad Saud, and I came across the PoC on LinkedIn, so I thought of sharing how it was performed.

📌 Bug reported by: Muhammad Saud

🔗 LinkedIn: Muhammad Saud

During security testing on DeepSeek AI’s chat platform, Muhammad Saud attempted various XSS payload injections to analyze input sanitization and execution restrictions. Here’s a breakdown of how he managed to bypass security measures and execute JavaScript:

He first tried a simple XSS payload to check whether DeepSeek AI filters malicious scripts:

💡 Outcome: The system blocked execution and only returned a textual explanation, meaning it had some basic protections…