PatchSiren cyber security CVE debrief
CVE-2026-32859 Vulncheck CVE debrief
CVE-2026-32859 describes a stored cross-site scripting issue in ByteDance DeerFlow’s artifacts API. The vulnerability affects versions prior to commit 5dbb362, where malicious HTML or script content uploaded as an artifact can later execute in a viewer’s browser context. Because the payload is stored and triggered on view, the main risks are session compromise, credential theft, and unauthorized actions in the affected user’s browser session. NVD listed the CVE as awaiting analysis at the time of the latest source update, and the issue is categorized as CWE-79.
- Vendor
- Vulncheck
- Product
- Unknown
- CVSS
- MEDIUM 5.1
- CISA KEV
- Not listed in stored evidence
- Original CVE published
- 2026-03-27
- Original CVE updated
- 2026-05-12
- Advisory published
- 2026-03-27
- Advisory updated
- 2026-05-12
Who should care
Organizations running ByteDance DeerFlow, especially teams that allow users to upload, store, or view artifacts through the web UI. Security teams, application owners, and developers responsible for content rendering and browser-side protections should prioritize review.
Technical summary
The issue is a stored XSS condition in DeerFlow’s artifacts API. The supplied source material says that attackers can upload malicious HTML or script content as artifacts, and that the content executes in the browser context when another user views the artifact. The vulnerability is mapped to CWE-79 and is present in versions prior to commit 5dbb362. The provided NVD metadata shows a CVSS 4.0 vector with low attack complexity, no privileges listed in the vector metadata, and user interaction required.
Defensive priority
Medium
Recommended defensive actions
- Update DeerFlow to a build that includes commit 5dbb362 or later.
- Review artifact upload and rendering paths to ensure untrusted content is escaped, sanitized, or served in a non-executable form.
- Limit who can upload artifacts and who can view them, especially in shared or high-trust environments.
- Use browser-side hardening such as a restrictive Content Security Policy where feasible.
- If exposure is suspected, review affected user sessions and rotate credentials or tokens as appropriate.
Evidence notes
This debrief uses only the supplied CVE description, NVD metadata, and referenced upstream links. Supported facts include the product name (ByteDance DeerFlow), the vulnerability class (stored XSS/CWE-79), the affected range (versions prior to commit 5dbb362), and the impact described in the source corpus. The corpus does not provide exploit proof, detailed root-cause analysis, or a formal vendor advisory write-up beyond the referenced URLs.
Official resources
CVE published on 2026-03-27. The source metadata attributes the disclosure to Vulncheck, and the latest provided NVD update on 2026-05-12 still listed the CVE as awaiting analysis. No KEV listing was provided in the source corpus.