Read the docs
TI-2026-30488 Aliases CVE-2026-42159

Flowsint: Stored XSS in description of node

Priority MEDIUM 57CWE-79Published · Updated

Key facts

Attack vector
Network
Privileges required
None
User interaction
Passive
Attack complexity
Low
Attack requirements
None
Impact type
Cross-site scripting
Confidentiality · integrity · availability
None · None · None
Fix status
Fixed

Attack profile from CVSS 4.0 · CNA. Fix status from CNA. Impact type from CWE-79.

Summary

Flowsint is an open-source OSINT graph exploration tool designed for cybersecurity investigation, transparency, and verification. Prior to 1.2.3, Flowsint allows a user to create investigations, which are used to manage sketches and analyses. Sketches have controllable graphs, which are comprised of nodes and relationships. The sketches contain information on an OSINT target (usernames, websites, etc) within these nodes and relationships. A remote attacker can create a node with a malicious description that contains arbitrary HTML. When the node is selected, it will render the arbitrary HTML, potentially triggering stored XSS. This vulnerability is fixed in 1.2.3.

Why it matters now

Exploitation Proof of concept CISA SSVC · not in CISA KEV
EPSS 0.00192 8th percentileScored 2026-11-07
Public exploit Yes 1 exploit referenceTagged by NVD
Fix Fixed flowsint (reconurge): 1.2.3

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
Poc
Automatable
No
Technical impact
Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
reconurgeflowsintbefore 1.2.31.2.3Patch availableCNA
  • flowsint Vendorreconurge Affected before 1.2.3 Fixed in 1.2.3 Patch available CNA

CPE configurations NVD · 1

CPEVersionsRoleVendor
cpe:2.3:a:flowsint:flowsint:*:*:*:*:*:*:*:*before 1.2.3VulnerableFlowsint
  • cpe:2.3:a:flowsint:flowsint:*:*:*:*:*:*:*:* Versions before 1.2.3 Vulnerable ·Flowsint

Remediation

  • Fix · CNA flowsint (reconurge) Fixed in 1.2.3

Timeline

  1. 2026-10-02 Threatist record created from CVE-2026-42159

References

Exploit 1

  • TI-2026-30485 Flowsint: Cypher query injection in node type on node creation CVSS 4.0HIGH 7.1
  • TI-2026-32317 Flowsint: Broken Access Control allows reading of sketch logs from any user CVSS 4.0MEDIUM 5.3
  • TI-2026-30486 Flowsint: Stored XSS on map node marker in map page CVSS 4.0MEDIUM 5.1
  • TI-2026-30487 Flowsint: Broken Access Control allows modification of investigation metadata from any user CVSS 4.0LOW 2.3

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences