Vulnerability · Published Mar 27, 2026 · Assigned by VulnCheck

CVE-2026-32859ByteDance DeerFlow Stored XSS via Inline Artifact Rendering

Medium 5.4

In plain English

A medium-severity cross-site scripting in DeerFlow from Bytedance Inc.. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.2% (higher than 10% of all known vulnerabilities).

Severity (CVSS 3.1)5.4Medium

Exploit odds (30 days)0.2%top 90.1% of all CVEs

Exploited in the wildNo reportsCISA SSVC: none

Attack toolingNoneno public tooling known

Official description

ByteDance DeerFlow versions prior to commit 5dbb362 contain a stored cross-site scripting vulnerability in the artifacts API that allows attackers to execute arbitrary scripts by uploading malicious HTML or script content as artifacts. Attackers can store malicious content that executes in the browser context when users view artifacts, leading to session compromise, credential theft, and arbitrary script execution.

Affected products (as reported)

Vendor	Product	Versions
Bytedance Inc.	DeerFlow	0 – before 5dbb3623b2f0e490c8bb3cd81b1e3b1b12eae1a6

Weakness: CWE-79 · Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N

References

https://github.com/bytedance/deer-flow/pull/1389 issue-tracking
https://github.com/bytedance/deer-flow/commit/5dbb3623b2f0e490c8bb3cd81b1e3b1b12eae1a6 patch
https://www.vulncheck.com/advisories/bytedance-deerflow-stored-xss-via-inline-artifact-rendering third-party-advisory