Track vulnerabilities like this one. Sign up free to get alerted when software you use is affected.
5.1

ByteDance Deer-Flow: Malicious Artifacts Can Steal Sessions and Data

CVE-2026-32859 · published 7 months ago
Summary

ByteDance Deer-Flow versions before a certain fix allow attackers to upload malicious content as artifacts, which can be executed in the user's browser when viewed. This can lead to stolen user sessions and data, as well as the execution of unauthorized scripts. Update to the latest version to fix this issue.

What to do
  • Update bytedance inc. deerflow to version 5dbb3623b2f0e490c8bb3cd81b1e3b1b12eae1a6 or later.
Affected software
VendorProductAffected versions
bytedance inc. deerflow < 5dbb3623b2f0e490c8bb3cd81b1e3b1b12eae1a6
Original advisory text
ByteDance DeerFlow Stored XSS via Inline Artifact Rendering
ByteDance DeerFlow versions prior to commit 5dbb362 contain a stored cross-site scripting vulnerability in the artifacts API that allows attackers to execute arbitrary scripts by uploading malicious HTML or script content as artifacts. Attackers can store malicious content that executes in the browser context when users view artifacts, leading to session compromise, credential theft, and arbitrary script execution.
References
Fix within
Internet-facing 60 days
Internal At next upgrade
  • Not known to be exploited
  • Needs hands-on effort to exploit
  • Gives an attacker partial control
Severity
5.1 Medium
Exploitation
<1% chance of attack within 30 days
Type
CWE-79Cross-site Scripting (XSS)
Timeline
Published27 Mar 2026
Updated4 Nov 2026
First seen27 Mar 2026
Sources
CVE-2026-32859 · NVD
CVE-2026-32859 · MITRE
CVE-2026-32859 · OSV
Track software like this
Free during beta