CVE-2026-34430

Katalog CVE

CVSS 9.6 · Critical EPSS 0,80%

Kerentanan Incomplete List of Disallowed Inputs pada deerflow. Skor CVSS 3.1 9.6 (Critical) menurut NVD.

Deskripsi (NVD)

ByteDance DeerFlow versions prior to commit 92c7a20 contain a sandbox escape vulnerability in bash tool handling that allows attackers to execute arbitrary commands on the host system by bypassing regex-based validation using shell features such as directory changes and relative paths. Attackers can exploit the incomplete shell semantics modeling to read and modify files outside the sandbox boundary and achieve arbitrary command execution through subprocess invocation with shell interpretation enabled.

Rincian

Terbit di NVD

1 April 2026

Terakhir diubah

14 Juli 2026

Status NVD

Undergoing Analysis

CVSS 3.1

9.6 (Critical), sumber NVD
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H · uraikan di kalkulator

Jenis kelemahan (CWE)

CWE-184: Incomplete List of Disallowed Inputs

EPSS (30 hari)

0,80% peluang dieksploitasi; lebih tinggi dari 55,5% CVE lain

Produk dan versi terdampak

> Data dari konfigurasi CPE di NVD.

Referensi dan perbaikan

• https://github.com/bytedance/deer-flow/pull/1547 issue tracking · patch · advisory vendor
• https://github.com/bytedance/deer-flow/commit/92c7a20cb74addc3038d2131da78f2e239ef542e patch
• https://www.vulncheck.com/advisories/bytedance-deerflow-localsandboxprovider-host-bash-escape advisory pihak ketiga · vdb entry