CVE-2026-42159
MediumCVSS 5.4Exploitation Probability (EPSS)
Low risk9th percentile - higher than 9% of all known CVEs
Summary
Prior to 1.2.3, Flowsint allows a remote attacker to create a node with a malicious description containing arbitrary HTML, which is rendered when the node is selected, potentially triggering stored XSS.
Risk Assessment
Stored XSS may allow an attacker to execute script in a victim's browser and steal session data.
Recommendation
Update Flowsint to version 1.2.3 or later.
Other vulnerabilities in Flowsint
See all- CVE-2026-32311Critical
Flowsint is an OSINT graph exploration tool that allows users to create investigations. Due to this vulnerability, a remote attacker can trigger the 'org_to_asn' transform on an organization node, allowing arbitrary OS commands to be executed as root on the host machine.
- CVE-2026-44352Medium
Prior to 1.2.3, Broken Access Control in Flowsint allows reading of sketch logs from any user. This vulnerability is fixed in 1.2.3.
- CVE-2026-42158Low
Flowsint is an open-source OSINT graph exploration tool. Prior to 1.2.3, an adversary with knowledge of an investigation ID could update the metadata of another user's investigation. This vulnerability is fixed in 1.2.3.
- CVE-2026-42157Medium
In Flowsint prior to 1.2.3, a remote attacker can create a map node with a malicious label containing arbitrary HTML. When the map tab is selected and a node marker is clicked, the arbitrary HTML is rendered, potentially triggering stored XSS.
- CVE-2026-42156High
Flowsint is an OSINT graph exploration tool that prior to version 1.2.3 allowed a remote attacker to create a node with a malicious type, which could lead to escaping an existing Cypher query and executing arbitrary Cypher queries.
Original NVD description (English source)
Flowsint is an open-source OSINT graph exploration tool designed for cybersecurity investigation, transparency, and verification. Prior to 1.2.3, Flowsint allows a user to create investigations, which are used to manage sketches and analyses. Sketches have controllable graphs, which are comprised of nodes and relationships. The sketches contain information on an OSINT target (usernames, websites, etc) within these nodes and relationships. A remote attacker can create a node with a malicious description that contains arbitrary HTML. When the node is selected, it will render the arbitrary HTML, potentially triggering stored XSS. This vulnerability is fixed in 1.2.3.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS