CVE-2026-42158

Flowsint is an OSINT graph exploration tool that allows users to create investigations. Due to this vulnerability, a remote attacker can trigger the 'org_to_asn' transform on an organization node, allowing arbitrary OS commands to be executed as root on the host machine.

Prior to 1.2.3, Flowsint allows a remote attacker to create a node with a malicious description containing arbitrary HTML, which is rendered when the node is selected, potentially triggering stored XSS.

Prior to 1.2.3, Broken Access Control in Flowsint allows reading of sketch logs from any user. This vulnerability is fixed in 1.2.3.

In Flowsint prior to 1.2.3, a remote attacker can create a map node with a malicious label containing arbitrary HTML. When the map tab is selected and a node marker is clicked, the arbitrary HTML is rendered, potentially triggering stored XSS.

Flowsint is an OSINT graph exploration tool that prior to version 1.2.3 allowed a remote attacker to create a node with a malicious type, which could lead to escaping an existing Cypher query and executing arbitrary Cypher queries.