ByteDance DeerFlow versions before commit 92c7a20 contain a sandbox escape vulnerability (CWE-184) due to incomplete validation of inputs in bash tool handling. Attackers can bypass regex-based input validation by leveraging shell features like directory changes and relative paths, which are not fully accounted for in the sandbox's input filtering. This allows them to read and modify files outside the sandbox and execute arbitrary commands on the host system through subprocesses invoked with shell interpretation enabled. The vulnerability is identified with a CVSS 4.0 score of 8.6, indicating high severity, and no known exploits in the wild have been reported. The product is not a cloud service, and no patch or remediation details are provided.

Successful exploitation allows an unauthenticated attacker to escape the sandbox environment, execute arbitrary commands on the host system, and read or modify files outside the intended sandbox boundaries. This can lead to significant system compromise. The vulnerability has a high CVSS score (8.6) reflecting its potential impact on confidentiality, integrity, and availability.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, users should consider restricting usage of vulnerable DeerFlow versions or applying additional sandboxing or input validation controls where possible. Monitor vendor channels for updates regarding patches or official mitigations.