A flaw in DeerFlow’s LocalSandboxProvider sanitizes bash input with an overly restrictive regex, letting an attacker supply shell constructs that move outside the intended sandbox. By changing directories or using relative paths, the attacker can read or write files beyond the sandbox boundary and then invoke arbitrary shell commands with the same privileges as the application. This leads to loss of confidentiality, integrity, and availability of the host system. The weakness corresponds to CWE‑184.

All DeerFlow releases built before commit 92c7a20cb74addc3038d2131da78f2e239ef542e are vulnerable; operators should verify that their installation contains that specific commit or a later one and apply the patch accordingly.

The CVSS base score is 8.6, indicating high severity. EPSS is below 1 %, and the issue is not in the CISA KEV catalog, so large‑scale exploitation is currently unlikely. The manipulation requires the attacker to influence the affected DeerFlow process; therefore the attack vector is inferred to be local rather than remote. No public exploit code has been reported.