Cross-Site Scripting in Flowintel Calendar Event Titles

CVE-2026-81814

What is CVE-2026-81814?

This vulnerability arises in Flowintel Calendar where event titles are rendered using innerHTML, allowing a user to input HTML or script content in case titles. When other users view the calendar, this content is executed in the browser, leading to potential security risks like unauthorized data access or account compromises. The issue has been addressed by sanitizing the output to use textContent instead of innerHTML, thus preventing script execution.

References