deer-flow vulnerabilities

CVEs whose affected-version data names the deer-flow package. Each record lists the affected and patched versions; check a specific version with the dependency checker or POST /api/sbom.

1 CVERSS

CVE-2026-40518High· 7.1PoC

6mo ago

ByteDance DeerFlow Path Traversal and Arbitrary File Write via Bootstrap Mode

ByteDance DeerFlow before commit 2176b2b contains a path traversal and arbitrary file write vulnerability in bootstrap-mode custom-agent creation where the agent name validation is bypassed. Attackers can supply traversal-style values or…

▾ Midnightbytedance · deer-flowEPSS 0.36%via CVEORG