Member-only story
⚡Critical XSS in DeepSeek AI
Hey guys! 👋 In today’s brief write-up, I’ll walk you through a critical reflected XSS vulnerability discovered in the newly launched DeepSeek AI. This bug was reported by Muhammad Saud, and I came across the PoC on LinkedIn, so I thought of sharing how it was performed.

📌 Bug reported by: Muhammad Saud
🔗 LinkedIn: Muhammad Saud
⚡ XSS Vulnerability Discovered in DeepSeek AI ⚡
During security testing on DeepSeek AI’s chat platform, Muhammad Saud attempted various XSS payload injections to analyze input sanitization and execution restrictions. Here’s a breakdown of how he managed to bypass security measures and execute JavaScript:
🔍 Step 1: Basic Payload Injection
He first tried a simple XSS payload to check whether DeepSeek AI filters malicious scripts:
<img src=x onerror=confirm(1)>
💡 Outcome: The system blocked execution and only returned a textual explanation, meaning it had some basic protections…