Read the docs
TI-2026-56449 Aliases CVE-2026-81820GHSA-cv7j-9q69-fxh4

Flowintel HTML Injection in MISP Case History Timeline via Crafted Object Attributes

Priority LOW 23CWE-79Published · Updated

Key facts

Attack vector
Network
Privileges required
Low
User interaction
Passive
Attack complexity
Low
Attack requirements
None
Impact type
Cross-site scripting
Confidentiality · integrity · availability
None · Low · None
Fix status
No fix listed

Attack profile from CVSS 4.0 · CNA. Fix status from CNA. Impact type from CWE-79.

Summary

Affected versions of Flowintel construct timeline HTML using attacker-controllable MISP object fields such as: * object UUID; * object name; * attribute value; * attribute type; * comment; * first/last seen values; * IDS flag. Those values were concatenated directly into HTML strings before rendering. The upstream commit explicitly states that DOMPurify removed XSS vectors but still allowed other HTML elements, such as forms, through. The fix replaces direct string interpolation with DOM construction via document.createElement() and assigns all attacker-controlled values using textContent. The headline is similarly converted to escaped HTML through a temporary element. Version impacted =>3.3.0

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.0039 33rd percentileScored 2026-11-07
Fix No fix listed No fixed version in the sources yet

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
None
Automatable
No
Technical impact
Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
flowintelflowintelup to 3.3.0—No fix listedCNA
  • flowintel Vendorflowintel Affected up to 3.3.0 Fixed in — No fix listed CNA

Remediation

No fixed version listed by the sources yet.

Timeline

  1. 2026-10-02 Threatist record created from CVE-2026-81820
  2. 2026-10-03 Alias added: GHSA-cv7j-9q69-fxh4

References

Patch 1

  • TI-2026-56455 Flowintel Fails to Invalidate Active Sessions After Password Change CVSS 4.0CRITICAL 9.1
  • TI-2026-56320 Flowintel Alert Settings Configuration Allows Remote Code Execution via Arbitrary Configuration Keys CVSS 4.0HIGH 8.6
  • TI-2026-56447 Flowintel Organization Administrator Can Reset Full Administrator Password and Escalate Privileges CVSS 4.0HIGH 8.6
  • TI-2026-56456 Flowintel Login Email Validation Bypass Allows Log Injection via Crafted Email Input CVSS 4.0MEDIUM 6.9
  • TI-2026-56389 Flowintel Arbitrary Log File Path Allows Remote Code Execution via Template Injection CVSS 4.0HIGH 7.5
  • TI-2026-56446 Flowintel Missing Task-to-Case Authorization Allows Cross-Case Task Modification CVSS 4.0HIGH 7.2
See all 12 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences