CVE-2026-32859

ByteDance DeerFlow Stored XSS via Inline Artifact Rendering

State: Published
Severity: 5.1 Medium
Published: Mar 27, 2026
Updated: Aug 14, 2026
Reserved: Mar 16, 2026

Description

ByteDance DeerFlow versions prior to commit 5dbb362 contain a stored cross-site scripting vulnerability in the artifacts API that allows attackers to execute arbitrary scripts by uploading malicious HTML or script content as artifacts. Attackers can store malicious content that executes in the browser context when users view artifacts, leading to session compromise, credential theft, and arbitrary script execution.

Scores

CVSS	Score	Vector	Source
4.0	5.1 Medium	CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:P/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N	VulnCheck
3.1	5.4 Medium	CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N	VulnCheck

Weaknesses

CWE-79 Improper neutralization of input during web page generation ('cross-site scripting')

Affected Products

Product	Versions
DeerFlowBytedance Inc.	before 5dbb3623b2f0e490c8bb3cd81b1e3b1b12eae1a6Affected

References

https://github.com/bytedance/deer-flow/pull/1389issue-tracking
https://github.com/bytedance/deer-flow/commit/5dbb3623b2f0e490c8bb3cd81b1e3b1b12eae1a6patch
https://www.vulncheck.com/advisories/bytedance-deerflow-stored-xss-via-inline-artifact-renderingthird-party-advisory

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.