[GH-ISSUE #1306] Cross-Site Scripting (XSS) via AI-Generated HTML Code Execution #850

New issue

Closed

opened 2026-10-26 21:31:08 +00:00 by bsakaguchi · 2 comments

bsakaguchi commented

2026-10-26 21:31:08 +00:00

Owner

Originally created by @ev1lclow3n on GitHub (May 14, 2026).
Original GitHub issue: https://github.com/deepseek-ai/DeepSeek-V3/issues/1306

Describe the bug
A Cross-Site Scripting (XSS) vulnerability was identified in the AI-generated HTML execution environment. The platform reproduces user-supplied HTML and JavaScript content without proper sanitization and executes it through the built-in “Run” functionality. By providing crafted HTML containing JavaScript code and instructing the AI model to repeat the content, arbitrary JavaScript execution was successfully achieved inside the embedded runtime environment.

To Reproduce
Open a chat session on the platform.
Provide HTML code containing a JavaScript payload such as alert("XSS").
Ask the AI model to reproduce or repeat the supplied HTML code exactly.
Execute the generated HTML using the “Run” functionality.
Observe that the JavaScript payload executes successfully inside the embedded page.

JS Payload Embedded in HTML File

<!DOCTYPE html>
<html>
<head>
<meta charset="UTF-8">
<title>TEST Decryptor</title>
<script src="https://cdnjs.cloudflare.com/ajax/libs/crypto-js/4.1.1/crypto-js.min.js"></script>
<style>
body{font-family:Arial;background:#f5f5f5;padding:40px}
.box{max-width:700px;margin:auto;background:#fff;padding:20px;border-radius:8px}
textarea{width:100%;height:120px;margin:10px 0;font-family:monospace}
button{background:#0a2986;color:#fff;border:0;padding:10px 20px;cursor:pointer}
#out{margin-top:15px;padding:10px;background:#f0f0f0;white-space:pre-wrap;display:none}
</style>
</head>
<body>

<div class="box">
<h2>🔓 TEST Decryptor</h2>

<textarea id="cipher">TEST</textarea>
<button onclick="dec()">Decrypt</button>

<div id="out"></div>
</div>

<script>
(() => {

const x="XYZ".split(',');
if(x.length!=2){
    alert("XSS by Sumit Tiwari.");
    return;
}

const key=CryptoJS.enc.Latin1.parse(x[0]),
      baseIV=x[1],
      out=document.getElementById('out');

function ivGen(s){
    let r=s.substring(0,5);
    if(r.length<5) r+="6b36d135".substring(0,5-r.length);
    return CryptoJS.enc.Latin1.parse(baseIV.slice(0,-5)+r);
}

function decrypt(v){
    let i=v.indexOf('|');
    if(i==-1) throw Error("Missing |");

    let ct=v.slice(0,i),
        sp=v.slice(i+1);

    let dec=CryptoJS.AES.decrypt(
        {ciphertext:CryptoJS.enc.Base64.parse(ct)},
        key,
        {
            iv:ivGen(sp),
            mode:CryptoJS.mode.CBC,
            padding:CryptoJS.pad.Pkcs7
        }
    ).toString(CryptoJS.enc.Utf8);

    if(!dec) throw Error("Decrypt failed");
    return dec;
}

window.dec=()=>{
    try{
        let r=decrypt(document.getElementById('cipher').value.trim());
        try{ r=JSON.stringify(JSON.parse(r),null,2)  #}catch(e){}
        out.style.display='block';
        out.textContent=r;
    }catch(e){
        out.style.display='block';
        out.textContent="❌ "+e.message;
    }
};

})();
</script>
</body>
</html>

Expected behavior
User-controlled HTML and JavaScript content should be properly sanitized or executed inside a strictly sandboxed environment where arbitrary script execution is prevented.

Screenshots

Additional context
The payload executed from the embedded runtime domain associated with the HTML execution environment after clicking the “Run” functionality. This behavior indicates insufficient sanitization and/or sandboxing of AI-generated HTML content before execution. The issue may allow attackers to execute arbitrary JavaScript, perform phishing attacks, manipulate rendered content, or conduct further client-side attacks against users interacting with generated previews.

#CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

Originally created by @ev1lclow3n on GitHub (May 14, 2026). Original GitHub issue: https://github.com/deepseek-ai/DeepSeek-V3/issues/1306 **Describe the bug** A Cross-Site Scripting (XSS) vulnerability was identified in the AI-generated HTML execution environment. The platform reproduces user-supplied HTML and JavaScript content without proper sanitization and executes it through the built-in “Run” functionality. By providing crafted HTML containing JavaScript code and instructing the AI model to repeat the content, arbitrary JavaScript execution was successfully achieved inside the embedded runtime environment. **To Reproduce** Open a chat session on the platform. Provide HTML code containing a JavaScript payload such as alert("XSS"). Ask the AI model to reproduce or repeat the supplied HTML code exactly. Execute the generated HTML using the “**Run**” functionality. Observe that the JavaScript payload executes successfully inside the embedded page. **JS Payload Embedded in HTML File** ``` <!DOCTYPE html> <html> <head> <meta charset="UTF-8"> <title>TEST Decryptor</title> <script src="https://cdnjs.cloudflare.com/ajax/libs/crypto-js/4.1.1/crypto-js.min.js"></script> <style> body{font-family:Arial;background:#f5f5f5;padding:40px} .box{max-width:700px;margin:auto;background:#fff;padding:20px;border-radius:8px} textarea{width:100%;height:120px;margin:10px 0;font-family:monospace} button{background:#0a2986;color:#fff;border:0;padding:10px 20px;cursor:pointer} #out{margin-top:15px;padding:10px;background:#f0f0f0;white-space:pre-wrap;display:none} </style> </head> <body> <div class="box"> <h2>🔓 TEST Decryptor</h2> <textarea id="cipher">TEST</textarea> <button onclick="dec()">Decrypt</button> <div id="out"></div> </div> <script> (() => { const x="XYZ".split(','); if(x.length!=2){ alert("XSS by Sumit Tiwari."); return; } const key=CryptoJS.enc.Latin1.parse(x[0]), baseIV=x[1], out=document.getElementById('out'); function ivGen(s){ let r=s.substring(0,5); if(r.length<5) r+="6b36d135".substring(0,5-r.length); return CryptoJS.enc.Latin1.parse(baseIV.slice(0,-5)+r); } function decrypt(v){ let i=v.indexOf('|'); if(i==-1) throw Error("Missing |"); let ct=v.slice(0,i), sp=v.slice(i+1); let dec=CryptoJS.AES.decrypt( {ciphertext:CryptoJS.enc.Base64.parse(ct)}, key, { iv:ivGen(sp), mode:CryptoJS.mode.CBC, padding:CryptoJS.pad.Pkcs7 } ).toString(CryptoJS.enc.Utf8); if(!dec) throw Error("Decrypt failed"); return dec; } window.dec=()=>{ try{ let r=decrypt(document.getElementById('cipher').value.trim()); try{ r=JSON.stringify(JSON.parse(r),null,2) #}catch(e){} out.style.display='block'; out.textContent=r; }catch(e){ out.style.display='block'; out.textContent="❌ "+e.message; } }; })(); </script> </body> </html> ``` **Expected behavior** User-controlled HTML and JavaScript content should be properly sanitized or executed inside a strictly sandboxed environment where arbitrary script execution is prevented. **Screenshots** <img width="959" height="510" alt="Image" src="https://github.com/user-attachments/assets/38733aa9-d6f0-42d3-a0ca-bbd3d6eeb2a8" /> **Additional context** The payload executed from the embedded runtime domain associated with the HTML execution environment after clicking the “Run” functionality. This behavior indicates insufficient sanitization and/or sandboxing of AI-generated HTML content before execution. The issue may allow attackers to execute arbitrary JavaScript, perform phishing attacks, manipulate rendered content, or conduct further client-side attacks against users interacting with generated previews. #CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

bsakaguchi

2026-10-26 21:31:08 +00:00

closed this issue
added the
stale

closed-as-stale
labels

bsakaguchi commented

2026-10-26 21:31:09 +00:00

Author

Owner

@github-actions[bot] commented on GitHub (Jun 14, 2026):

This issue has been automatically marked as stale because it has not had recent activity. It will be closed if no further activity occurs. If you believe this issue is still relevant, please leave a comment to keep it open. Thank you for your contributions!

@github-actions[bot] commented on GitHub (Jun 14, 2026): This issue has been automatically marked as stale because it has not had recent activity. It will be closed if no further activity occurs. If you believe this issue is still relevant, please leave a comment to keep it open. Thank you for your contributions!

bsakaguchi commented

2026-10-26 21:31:09 +00:00

Author

Owner

@github-actions[bot] commented on GitHub (Jul 11, 2026):

false

@github-actions[bot] commented on GitHub (Jul 11, 2026): false