CVE-2026-32859 is a stored cross-site scripting vulnerability (CWE-79) in ByteDance Inc.'s DeerFlow product affecting versions prior to commit 5dbb362. The vulnerability exists in the artifacts API, where malicious HTML or script content can be uploaded and stored. When users view these artifacts, the malicious scripts execute in their browser context, potentially leading to session hijacking, credential theft, and arbitrary script execution. The CVSS 4.0 vector indicates network attack vector, low attack complexity, no privileges required, user interaction needed, and low scope and impact on confidentiality, integrity, and availability.

Successful exploitation allows attackers to execute arbitrary scripts in the context of users viewing the malicious artifacts. This can result in session compromise, theft of user credentials, and execution of arbitrary code within the victim's browser session. The impact is limited to the affected users who view the malicious artifacts. There is no indication of broader system compromise or escalation beyond the browser context.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. No official fix or patch information is provided in the available data. Until a patch is available, restrict artifact uploads to trusted users only and consider implementing input validation or sanitization on the artifacts API to prevent malicious content upload. Monitor vendor communications for updates on remediation.