DeerFlow vulnerabilities
CVEs whose affected-version data names the DeerFlow package. Each record lists the affected and patched versions; check a specific version with the dependency checker or POST /api/sbom.
2 CVEsRSS
CVE-2026-34430High· 8.8ByteDance DeerFlow LocalSandboxProvider Host Bash Escape
ByteDance DeerFlow versions prior to commit 92c7a20 contain a sandbox escape vulnerability in bash tool handling that allows attackers to execute arbitrary commands on the host system by bypassing regex-based validation using shell featu…
▾ TwilightBytedance Inc. · DeerFlowEPSS 0.41%via CVEORG
CVE-2026-32859Medium· 5.4ByteDance DeerFlow Stored XSS via Inline Artifact Rendering
ByteDance DeerFlow versions prior to commit 5dbb362 contain a stored cross-site scripting vulnerability in the artifacts API that allows attackers to execute arbitrary scripts by uploading malicious HTML or script content as artifacts. A…
▾ SunlitBytedance Inc. · DeerFlowEPSS 0.20%via CVEORG