A critical sandbox escape vulnerability in ByteDance DeerFlow allows unauthenticated attackers to achieve remote code execution on the underlying host system.

The vulnerability stems from incomplete shell semantics modeling, which allows attackers to bypass regex-based input validation using shell features. An unauthenticated attacker can exploit this to read or modify files outside the sandbox boundary and execute arbitrary commands via subprocess invocation.

Successful exploitation of this vulnerability poses a severe threat to the integrity and confidentiality of the host environment. Given the CVSS score of 8.8, this flaw represents a High severity risk that could lead to full system compromise, unauthorized data access, and the potential for lateral movement within the network infrastructure.

Immediate Action: Update the DeerFlow installation to the latest version or apply the fix provided in commit 92c7a20cb74addc3038d2131da78f2e239ef542e.

Proactive Monitoring: Monitor system logs for unusual subprocess invocations or attempts to access files outside of designated sandbox directories.

Compensating Controls: Implement strict egress filtering and ensure that the sandbox environment runs with the least privilege necessary to limit the impact of potential escapes.

Public Exploit Available: Unknown

Due to the potential for arbitrary code execution, this vulnerability should be treated with high urgency. Administrators are strongly advised to verify their current version of DeerFlow and apply the referenced commit or vendor-provided patch immediately to eliminate the sandbox escape vector.