Cross-Site Scripting in Flowintel Affecting Dynamic HTML Rendering
CVE-2026-81820

5.1MEDIUM

Key Information:

Vendor

Flowintel

Status
Flowintel
Vendor
CVE Published:
27 August 2026

What is CVE-2026-81820?

A flaw in Flowintel's handling of dynamically constructed HTML allows attackers to inject arbitrary HTML and JavaScript into rendered pages. This vulnerability arises from concatenating user-controlled MISP object fields—including UUIDs, names, and comments—directly into HTML strings. Although recent patches using DOMPurify aimed to mitigate XSS risks, they inadvertently permitted the inclusion of additional HTML elements, such as forms. The recommended fix involves utilizing document.createElement() for proper DOM construction, ensuring that any user-controlled data is safely set using textContent. This approach effectively neutralizes potential scripting threats.

Affected Version(s)

flowintel 0 <= 3.3.0

References

https://github.com/flowintel/flowintel/commit/11f71e747d9...
patch

CVSS V4

Score:
5.1
Severity:
MEDIUM
Confidentiality:
None
Integrity:
Low
Availability:
None
Attack Vector:
Network
Attack Complexity:
Low
Attack Required:
None
Privileges Required:
Undefined
User Interaction:
Unknown

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

Jeroen Pinoy
David Cruciani
.