CVE-2025-63872

Medium · 6.1

CVSS

6.1

EPSS

0.3%

Published

Dec 2, 2025

CISA due date

—

The record

DeepSeek V3.2 has a Cross Site Scripting (XSS) vulnerability, which allows JavaScript execution through model-generated SVG content.

Ecosystem	Package	Introduced	Fixed