86 matches found
CVE-2026-34430
ByteDance DeerFlow versions prior to commit 92c7a20 contain a sandbox escape vulnerability in bash tool handling that allows attackers to execute arbitrary commands on the host system by bypassing regex-based validation using shell features such as directory changes and relative paths. Attackers...
DeerFlow 安全漏洞
DeerFlow is an open-source orchestration framework developed by Bytedance, used to coordinate sub-proxies and skill executions. Versions of DeerFlow prior to 92c7a20 contained security vulnerabilities. These vulnerabilities stemmed from sandbox escapes in bash tool processing. Attackers could...
CVE-2026-34430: Incomplete List of Disallowed Inputs
ByteDance DeerFlow versions prior to commit 92c7a20 contain a sandbox escape vulnerability in bash tool handling that allows attackers to execute arbitrary commands on the host system by bypassing regex-based validation using shell features such as directory changes and relative paths. Attackers...
CVE-2026-32859
ByteDance DeerFlow versions prior to commit 5dbb362 contain a stored cross-site scripting vulnerability in the artifacts API that allows attackers to execute arbitrary scripts by uploading malicious HTML or script content as artifacts. Attackers can store malicious content that executes in the...
CVE-2026-32859 ByteDance DeerFlow Stored XSS via Inline Artifact Rendering
ByteDance DeerFlow versions prior to commit 5dbb362 contain a stored cross-site scripting vulnerability in the artifacts API that allows attackers to execute arbitrary scripts by uploading malicious HTML or script content as artifacts. Attackers can store malicious content that executes in the...
CVE-2026-32859: Improper Neutralization of Input During Web Page Generation
ByteDance DeerFlow versions prior to commit 5dbb362 contain a stored cross-site scripting vulnerability in the artifacts API that allows attackers to execute arbitrary scripts by uploading malicious HTML or script content as artifacts. Attackers can store malicious content that executes in the...
KRONE: Hierarchical and Modular Log Anomaly Detection
Log anomaly detection is crucial for uncovering system failures and security risks. Although logs originate from nested component executions with clear boundaries, this structure is lost when they are stored as flat sequences. As a result, state-of-the-art methods risk missing true dependencies...
Malicious Package
Overview bytedance-i18n-ghook is a malicious package. This package contains malicious code, and its content was removed from the official package manager. While this package might be attempting to impersonate a valid organization, there is no connection between that organization and this package...
Malicious Package
Overview bytedance-i18n-hooks is a malicious package. This package contains malicious code, and its content was removed from the official package manager. While this package might be attempting to impersonate a valid organization, there is no connection between that organization and this package...
Malicious Package
Overview plugin-compiler-bytedance is a malicious package. This package contains malicious code, and its content was removed from the official package manager. While this package might be attempting to impersonate a valid organization, there is no connection between that organization and this...
DeepSeek found to be sharing user data with TikTok parent company ByteDance
A couple of weeks ago we reported on the concerns surrounding data collection and security at DeepSeek, the Chinese AI company which recently made headlines for shaking up the industry after seemingly appearing from nowhere to become top of the app download charts. Now South Korea’s Personal...
MAL-2025-906 Malicious code in bytedance-chat (PyPI)
--- -= Per source details. Do not edit below this line.=-...
Warning: Don’t sell or buy a second hand iPhone with TikTok already installed
After TikTok was briefly banned in the US last weekend, an unusual phenomenon unearthed. Reportedly, people are selling iPhones that have TikTok installed for up to $25,000. This may require some explanation, so bear with me. TikTok has had a rough time in the US the last weeks. The ban we...
TikTok Goes Dark in the U.S. as Federal Ban Takes Effect January 19, 2025
Popular video-sharing social network TikTok has officially gone dark in the United States, as a federal ban on the app comes into effect on January 19, 2025. "We regret that a U.S. law banning TikTok will take effect on January 19 and force us to make our services temporarily unavailable," the...
TikTok ban in US: Company seeks emergency injunction to prevent it
TikTok has requested an emergency injunction to stop or postpone the planned ban on the platform in the US. Back in March, the House of Representatives passed a bill that would effectively ban TikTok from the US unless Chinese owner ByteDance agreed to give up its share of the immensely popular...
Malicious code in plugin-compiler-bytedance (npm)
--- -= Per source details. Do not edit below this line.=-...
MAL-2024-11421 Malicious code in plugin-compiler-bytedance (npm)
--- -= Per source details. Do not edit below this line.=-...
MAL-2024-11320 Malicious code in bytedance-i18n-hooks (npm)
--- -= Per source details. Do not edit below this line.=-...