Executive brief
ByteDance DeerFlow is an AI agent framework that allows automated tasks to run in a protected environment. A security flaw in its local sandbox allows attackers to bypass safety restrictions and execute commands directly on the host computer. This could lead to the theft of sensitive files, unauthorized modification of data, or full system compromise if the framework processes a malicious prompt.
Technical details
A sandbox escape vulnerability exists in DeerFlow's LocalSandboxProvider due to incomplete shell semantics modeling. The system relied on regex-based validation of absolute paths to restrict bash commands; however, attackers can bypass these checks using shell features like directory changes ('cd') and relative paths. Because the validated command is ultimately executed via subprocess.run with shell=True on the host, an attacker can read or modify files outside the intended /mnt/user-data boundary. The fix implements a deny-by-default approach for host bash execution in local mode, requiring an explicit opt-in via configuration.
Affected products
- ByteDance DeerFlow prior to commit 92c7a20
Timeline
- 2026-03-29: patched: Commit 92c7a20cb74addc3038d2131da78f2e239ef542e merged
- 2026-04-01: disclosed: CVE-2026-34430 published