CVE-2026-42157
MediumCVSS 5.1Exploitation Probability (EPSS)
Low risk28th percentile - higher than 28% of all known CVEs
Summary
In Flowsint prior to 1.2.3, a remote attacker can create a map node with a malicious label containing arbitrary HTML. When the map tab is selected and a node marker is clicked, the arbitrary HTML is rendered, potentially triggering stored XSS.
Risk Assessment
Malicious code stored in a node label may execute in other users' browsers, leading to session theft or actions performed on their behalf. The risk affects all users viewing the map.
Recommendation
Update Flowsint to version 1.2.3 or later. Until updated, restrict access to the map feature and verify node data sources.
Other vulnerabilities in Flowsint
See all- CVE-2026-32311Critical
Flowsint is an OSINT graph exploration tool that allows users to create investigations. Due to this vulnerability, a remote attacker can trigger the 'org_to_asn' transform on an organization node, allowing arbitrary OS commands to be executed as root on the host machine.
- CVE-2026-42159Medium
Prior to 1.2.3, Flowsint allows a remote attacker to create a node with a malicious description containing arbitrary HTML, which is rendered when the node is selected, potentially triggering stored XSS.
- CVE-2026-44352Medium
Prior to 1.2.3, Broken Access Control in Flowsint allows reading of sketch logs from any user. This vulnerability is fixed in 1.2.3.
- CVE-2026-42158Low
Flowsint is an open-source OSINT graph exploration tool. Prior to 1.2.3, an adversary with knowledge of an investigation ID could update the metadata of another user's investigation. This vulnerability is fixed in 1.2.3.
- CVE-2026-42156High
Flowsint is an OSINT graph exploration tool that prior to version 1.2.3 allowed a remote attacker to create a node with a malicious type, which could lead to escaping an existing Cypher query and executing arbitrary Cypher queries.
Original NVD description (English source)
Flowsint is an open-source OSINT graph exploration tool designed for cybersecurity investigation, transparency, and verification. Prior to 1.2.3, a remote attacker can create a map node with a malicious label that contains arbitrary HTML. When the map tab is selected and a map node marker is selected, it will render the arbitrary HTML, potentially triggering stored XSS. This vulnerability is fixed in 1.2.3.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS