CVE-2026-42156

High

Published: 12/05/2026(UTC)Translated: 15/06/2026(UTC)NVD NIST

Summary

Flowsint is an OSINT graph exploration tool that prior to version 1.2.3 allowed a remote attacker to create a node with a malicious type, which could lead to escaping an existing Cypher query and executing arbitrary Cypher queries.

Risk Assessment

An attacker could exploit this vulnerability to perform unauthorized operations on the database, posing a serious threat to data integrity.

Recommendation

It is recommended to upgrade to version 1.2.3 or later to mitigate this vulnerability.

Other vulnerabilities in Flowsint

CVE-2026-32311Critical
Flowsint is an OSINT graph exploration tool that allows users to create investigations. Due to this vulnerability, a remote attacker can trigger the 'org_to_asn' transform on an organization node, allowing arbitrary OS commands to be executed as root on the host machine.

Original NVD description (English source)

Flowsint is an open-source OSINT graph exploration tool designed for cybersecurity investigation, transparency, and verification. Prior to 1.2.3, a remote attacker can create a node with a malicious type that can escape an existing Cypher query and an adversary can execute an arbitrary Cypher query. This vulnerability is fixed in 1.2.3.