django-ai-support (0.1.11), mseep-deer-flow (>=0.1.0, <=0.1.1) potentially affected by CVE-2026-55253 via langgraph-checkpoint-mongodb (>=0.2.1, <=0.3.1)

langgraph-checkpoint-mongodb PYPI version =0.2.1, =0.1.0, =0.1.1 Source cves: CVE-2026-55253 Source advisory: MEND:CVE-2026-55253...

mseep-deer-flow (>=0.1.0, <=0.1.1) potentially affected by CVE-2026-55253 via langgraph-checkpoint-mongodb (0.2.1)

langgraph-checkpoint-mongodb PYPI version 0.2.1 is affected by a known vulnerability. The following packages have a transitive dependency on langgraph-checkpoint-mongodb and may be impacted: - mseep-deer-flow =0.1.0, =0.1.1 Source cves: CVE-2026-55253 Source advisory: OSV:PYSEC-2026-3859...

mseep-deer-flow (>=0.1.0, <=0.1.1) potentially affected by CVE-2026-55253 via langgraph-checkpoint-mongodb (0.2.1)

langgraph-checkpoint-mongodb PYPI version 0.2.1 is affected by a known vulnerability. The following packages have a transitive dependency on langgraph-checkpoint-mongodb and may be impacted: - mseep-deer-flow =0.1.0, =0.1.1 Source cves: CVE-2026-55253 Source advisory: GHSA-533J-2V4Q-MW5H...

mseep-deer-flow (>=0.1.0, <=0.1.1) potentially affected by CVE-2026-55253 via langgraph-checkpoint-mongodb (0.2.1)

langgraph-checkpoint-mongodb PYPI version 0.2.1 is affected by a known vulnerability. The following packages have a transitive dependency on langgraph-checkpoint-mongodb and may be impacted: - mseep-deer-flow =0.1.0, =0.1.1 Source cves: CVE-2026-55253 Source advisory: OSV:GHSA-533J-2V4Q-MW5H...

langgraph-agent-toolkit (>=0.7.8, <=0.7.23), mseep-deer-flow (>=0.1.0, <=0.1.1) potentially affected by CVE-2026-71433 via langgraph-checkpoint-postgres (2.0.21)

langgraph-checkpoint-postgres PYPI version 2.0.21 is affected by a known vulnerability. The following packages have a transitive dependency on langgraph-checkpoint-postgres and may be impacted: - langgraph-agent-toolkit =0.7.8, =0.1.0, =0.1.1 Source cves: CVE-2026-71433 Source advisory:...

langgraph-agent-toolkit (>=0.7.8, <=0.7.23), mseep-deer-flow (>=0.1.0, <=0.1.1) potentially affected by CVE-2026-71433 via langgraph-checkpoint-postgres (2.0.21)

langgraph-checkpoint-postgres PYPI version 2.0.21 is affected by a known vulnerability. The following packages have a transitive dependency on langgraph-checkpoint-postgres and may be impacted: - langgraph-agent-toolkit =0.7.8, =0.1.0, =0.1.1 Source cves: CVE-2026-71433 Source advisory:...

CVE-2026-34430

ByteDance DeerFlow versions prior to commit 92c7a20 contain a sandbox escape vulnerability in bash tool handling that allows attackers to execute arbitrary commands on the host system by bypassing regex-based validation using shell features such as directory changes and relative paths. Attackers...

EUVD-2026-17903

ByteDance Deer-Flow versions prior to commit 92c7a20 contain a sandbox escape vulnerability in bash tool handling that allows attackers to execute arbitrary commands on the host system by bypassing regex-based validation using shell features such as directory changes and relative paths. Attackers...

CVE-2026-34430

ByteDance DeerFlow versions prior to commit 92c7a20 contain a sandbox escape vulnerability in bash tool handling that allows attackers to execute arbitrary commands on the host system by bypassing regex-based validation using shell features such as directory changes and relative paths. Attackers...

CVE-2026-32859

ByteDance DeerFlow versions prior to commit 5dbb362 contain a stored cross-site scripting vulnerability in the artifacts API that allows attackers to execute arbitrary scripts by uploading malicious HTML or script content as artifacts. Attackers can store malicious content that executes in the...

CVE-2026-32859

ByteDance DeerFlow versions prior to commit 5dbb362 contain a stored cross-site scripting vulnerability in the artifacts API that allows attackers to execute arbitrary scripts by uploading malicious HTML or script content as artifacts. Attackers can store malicious content that executes in the...

PT-2026-28445

Name of the Vulnerable Software and Affected Versions ByteDance Deer-Flow versions prior to commit 5dbb362 Description The software contains a stored cross-site scripting issue in the artifacts API. An attacker can execute arbitrary scripts by uploading malicious HTML or script content as...