DeepSeek vulnerabilities
We track 3 vulnerabilities in DeepSeek products across 5 products. 3 are rated high or critical, and none are known to be exploited. The most recent was published on October 26, 2026.
Latest DeepSeek vulnerabilities
- 7.3 High severity
Harness: Incorrect Privilege Assignment
A vulnerability was determined in DeepSeek Harness up to 0.2.0-rc.2. This issue affects some unknown processing of the file packages/client/connection/src/browser-auth.ts of the component Browser Auth. This manipulation causes improper authorization. The attac
- 9.6 Critical severity
DeepSeek Harness: Reliance on Untrusted Inputs in a Security Decision
DeepSeek Harness before 0.1.2-alpha.1 contains an authentication bypass vulnerability that grants unauthenticated access to its local HTTP agent-control API by accepting a client-supplied loopback Host header in place of validating the actual TCP connection or
- 8.8 High severity
Deepseek-r1: Improper Neutralization of Input During Web Page Generation
DeepSeek R1 through V3.1 allows XSS, as demonstrated by JavaScript execution in the context of the run-html-chat.deepseeksvc.com domain. NOTE: some third parties have indicated that this is intended behavior.