Read the docs
TI-2026-56390 Aliases CVE-2026-81753GHSA-4xww-rqhr-67w2

Flowintel Stored XSS in Case Notes via Malicious Mermaid Diagram Content

Priority LOW 24CWE-79Published · Updated

Key facts

Attack vector
Network
Privileges required
Low
User interaction
Passive
Attack complexity
Low
Attack requirements
None
Impact type
Cross-site scripting
Confidentiality · integrity · availability
Low · Low · None
Fix status
No fix listed

Attack profile from CVSS 4.0 · CNA. Fix status from CNA. Impact type from CWE-79.

Summary

Affected versions of Flowintel render Mermaid blocks contained in stored case notes without sufficiently neutralizing attacker-controlled markup. Because Mermaid note content is persisted and later rendered for other users, an attacker with permission to create or edit a note could store a crafted Mermaid payload that results in JavaScript execution when another user views the affected case note. The patch adds explicit Mermaid detection and HTML escaping around the token content before the generated Mermaid wrapper is returned. It also moves the wrapping logic earlier in page initialization so Markdown instances are protected consistently. Version impacted >= 3.3.0

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.00546 46th percentileScored 2026-11-07
Fix No fix listed No fixed version in the sources yet

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
None
Automatable
No
Technical impact
Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
flowintelflowintelup to 3.3.0—No fix listedCNA
  • flowintel Vendorflowintel Affected up to 3.3.0 Fixed in — No fix listed CNA

Remediation

No fixed version listed by the sources yet.

Timeline

  1. 2026-10-02 Threatist record created from CVE-2026-81753
  2. 2026-10-03 Alias added: GHSA-4xww-rqhr-67w2

References

Patch 1

  • TI-2026-56455 Flowintel Fails to Invalidate Active Sessions After Password Change CVSS 4.0CRITICAL 9.1
  • TI-2026-56320 Flowintel Alert Settings Configuration Allows Remote Code Execution via Arbitrary Configuration Keys CVSS 4.0HIGH 8.6
  • TI-2026-56447 Flowintel Organization Administrator Can Reset Full Administrator Password and Escalate Privileges CVSS 4.0HIGH 8.6
  • TI-2026-56456 Flowintel Login Email Validation Bypass Allows Log Injection via Crafted Email Input CVSS 4.0MEDIUM 6.9
  • TI-2026-56389 Flowintel Arbitrary Log File Path Allows Remote Code Execution via Template Injection CVSS 4.0HIGH 7.5
  • TI-2026-56446 Flowintel Missing Task-to-Case Authorization Allows Cross-Case Task Modification CVSS 4.0HIGH 7.2
See all 12 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences