CVE-2026-42156
HighCVSS 7.1Exploitation Probability (EPSS)
Low risk28th percentile - higher than 28% of all known CVEs
Summary
Flowsint is an OSINT graph exploration tool that prior to version 1.2.3 allowed a remote attacker to create a node with a malicious type, which could lead to escaping an existing Cypher query and executing arbitrary Cypher queries.
Risk Assessment
An attacker could exploit this vulnerability to perform unauthorized operations on the database, posing a serious threat to data integrity.
Recommendation
It is recommended to upgrade to version 1.2.3 or later to mitigate this vulnerability.
Other vulnerabilities in Flowsint
See all- CVE-2026-32311Critical
Flowsint is an OSINT graph exploration tool that allows users to create investigations. Due to this vulnerability, a remote attacker can trigger the 'org_to_asn' transform on an organization node, allowing arbitrary OS commands to be executed as root on the host machine.
- CVE-2026-42159Medium
Prior to 1.2.3, Flowsint allows a remote attacker to create a node with a malicious description containing arbitrary HTML, which is rendered when the node is selected, potentially triggering stored XSS.
- CVE-2026-44352Medium
Prior to 1.2.3, Broken Access Control in Flowsint allows reading of sketch logs from any user. This vulnerability is fixed in 1.2.3.
- CVE-2026-42158Low
Flowsint is an open-source OSINT graph exploration tool. Prior to 1.2.3, an adversary with knowledge of an investigation ID could update the metadata of another user's investigation. This vulnerability is fixed in 1.2.3.
- CVE-2026-42157Medium
In Flowsint prior to 1.2.3, a remote attacker can create a map node with a malicious label containing arbitrary HTML. When the map tab is selected and a node marker is clicked, the arbitrary HTML is rendered, potentially triggering stored XSS.
Original NVD description (English source)
Flowsint is an open-source OSINT graph exploration tool designed for cybersecurity investigation, transparency, and verification. Prior to 1.2.3, a remote attacker can create a node with a malicious type that can escape an existing Cypher query and an adversary can execute an arbitrary Cypher query. This vulnerability is fixed in 1.2.3.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS