Remote Command Execution Vulnerability in Flowsint by Reconurge

CVE-2026-32311

What is CVE-2026-32311?

Flowsint, an open-source OSINT graph exploration tool by Reconurge, is susceptible to a remote command execution vulnerability. This arises when a remote attacker creates a sketch and triggers the 'org_to_asn' transformer on an organization node, leading to the execution of arbitrary OS commands as root on the host machine. This is facilitated through the use of shell metacharacters and can compromise the entire system, potentially allowing the attacker to gain full control. A recent code commit has been made to address this issue by removing the vulnerable code.

References