CVE-2026-32859 is a stored cross-site scripting vulnerability in ByteDance DeerFlow's artifacts API present in versions prior to commit 5dbb362. Attackers can upload malicious HTML or script content as artifacts, which are then executed in the browser context of users who view these artifacts. This improper neutralization of input during web page generation (CWE-79) can lead to session compromise, credential theft, and arbitrary script execution. The vulnerability has a CVSS 4.0 score of 5.1 (medium severity) with network attack vector, low attack complexity, and requires user interaction.

Successful exploitation allows attackers to execute arbitrary scripts in the context of the victim's browser when viewing malicious artifacts. This can result in session hijacking, theft of credentials, and execution of arbitrary code within the user's browser session, potentially compromising user accounts and data.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. No official fix or patch links are provided in the available data. Users should monitor ByteDance's advisories for updates and apply any official patches or commits that address this vulnerability once released. Until then, caution should be exercised when handling artifacts from untrusted sources.