CVE-2026-34430 is a high severity (CVSS 8.8) sandbox escape in ByteDance DeerFlow, in the bash tool handling. Regex validation misses shell features, which allows commands outside the sandbox. The fix is commit 92c7a20, so update past it. Run shell-capable agents in a container.
What's affected
The record and VulnCheck's advisory list DeerFlow versions prior to commit 92c7a20. The fix is that commit, from pull request 1547 in the bytedance/deer-flow repository. I found no release number tied to it, so check the project's releases or pull the code at or after that commit.
The advisory names the LocalSandboxProvider component. It describes validation based on regular expressions that models the shell incompletely, so features such as directory changes and relative paths get past it, and a subprocess started with shell interpretation then runs the command.
How to check if you're exposed
If you run DeerFlow from source, check that your checkout includes commit 92c7a20:
git merge-base --is-ancestor 92c7a20 HEAD && echo fixed || echo not fixed
For an image, find out which commit it was built from. Also check whether the local sandbox provider is enabled, since the flaw concerns that provider.
What to do now
- Find DeerFlow deployments and which commit they run.
- Update to a build that contains commit 92c7a20.
- Run agents that execute shell commands in a container or VM, and not directly on a host.
- Give the agent process a low-privilege account with no access to secrets.
- Review shell tool logs for commands that touched paths outside the workspace.
Why it matters
The weakness is CWE-184, incomplete list of disallowed inputs. A pattern list tries to name every bad command, and the shell is too rich for that. There are many ways to reach the same file or run the same program.
For tools that let a model run commands, the stronger design is a real boundary such as a container with limited mounts, rather than text filtering. The record does not mark this as exploited and it is not on the CISA KEV list. The vector notes user interaction is required.
Quick check
Why do regex filters fail for shell commands?
The shell offers many ways to express the same action, so a list of blocked patterns is always incomplete.
Sources
Last reviewed: 19 October 2026.
