Which versions of Flowsint are affected by CVE-2026-32311?

Flowsint OSINT tool contains a critical remote code execution vulnerability (CVSS 9.3) that allows unauthenticated attackers to execute arbitrary commands as root on host systems through container…

How to fix or mitigate CVE-2026-32311?

Within 24 hours: Immediately isolate or air-gap all Flowsint instances from internet access; disable or restrict network access to the 'org_to_asn' transformer functionality if possible; audit logs for exploitation attempts (shell metacharacter injection patterns in org node processing). Within 7 days: Contact Flowsint vendor for release date of patched version containing commit b52cbbb904c; implement network segmentation if Flowsint cannot be removed; deploy Web Application Firewall (WAF) rules to block requests with shell metacharacters to Flowsint endpoints if temporary internet exposure is unavoidable. Within 30 days: Deploy vendor-released patched Flowsint version once available; complete forensic review of affected systems for unauthorized access or lateral movement; validate patch effectiveness in isolated test environment before production deployment.

Flowsint CVE-2026-32311

Q: What is the CVSS score of CVE-2026-32311?

CVE-2026-32311 has a CVSS 4.0 base score of 9.3 (Critical). CVSS vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.2%.

EUVD-2026-23946 CRITICAL

OS Command Injection (CWE-78)

2026-04-20 GitHub_M

Docker Command Injection

9.3

CVSS 4.0 · GitHub Advisory

Severity by source

GitHub Advisory PRIMARY

9.3 CRITICAL

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Primary rating from GitHub Advisory · only source for this CVE.

CVSS VectorGitHub Advisory

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Lifecycle Timeline

Analysis Updated

Apr 21, 2026 - 15:27 vuln.today

v2 (cvss_changed)

Re-analysis Queued

Apr 21, 2026 - 15:22 vuln.today

cvss_changed

Analysis Generated

Apr 20, 2026 - 20:33 vuln.today

CVSS changed

Apr 20, 2026 - 20:22 NVD

9.3 (CRITICAL)

EUVD ID Assigned

Apr 20, 2026 - 20:00 euvd

EUVD-2026-23946

Analysis Generated

Apr 20, 2026 - 20:00 vuln.today

CVE Published

Apr 20, 2026 - 19:56 nvd

CRITICAL 9.3

DescriptionGitHub Advisory

Flowsint is an open-source OSINT graph exploration tool designed for cybersecurity investigation, transparency, and verification. Flowsint allows a user to create investigations, which are used to manage sketches and analyses. Sketches have controllable graphs, which are comprised of nodes and relationships. The sketches contain information on an OSINT target (usernames, websites, etc) within these nodes and relationships. The nodes can have automated processes execute on them called 'transformers'. A remote attacker can create a sketch, then trigger the 'org_to_asn' transform on an organization node to execute arbitrary OS commands as root on the host machine via shell metacharacters and a docker container escape. Commit b52cbbb904c8013b74308d58af88bc7dbb1b055c appears to remove the code that causes this issue.

AnalysisAI

Remote code execution with container escape in Flowsint OSINT tool allows unauthenticated attackers to execute arbitrary OS commands as root on the host machine. The vulnerability exploits shell metacharacter injection in the 'org_to_asn' transformer when processing organization nodes in OSINT sketches. With CVSS 9.3 (CVSS 4.0), network attack vector, low complexity, and no authentication required, this represents critical risk to any internet-exposed Flowsint instance. Upstream fix committed (b52cbbb904c) removes vulnerable code, but no tagged release version confirmed yet. CVSS vector indicates proof-of-concept exploit exists (E:P).

Technical ContextAI

Flowsint is an open-source OSINT (Open Source Intelligence) graph exploration tool built with Docker containerization. The vulnerability is a classic OS command injection (CWE-78) in the 'org_to_asn' transformer component, which performs automated analysis on organization nodes within investigation sketches. The flaw stems from improper sanitization of user-controlled input passed to shell commands within the Docker container. When shell metacharacters (e.g., semicolons, pipes, backticks) are embedded in organization node data, they are executed by the underlying shell. The attack achieves container escape, elevating from in-container execution to root-level host OS command execution - effectively breaking Docker's isolation boundary. This represents a critical failure in input validation combined with unsafe process spawning and inadequate container security controls.

RemediationAI

Apply upstream fix by updating Flowsint to commit b52cbbb904c8013b74308d58af88bc7dbb1b055c or later (https://github.com/reconurge/flowsint/commit/b52cbbb904c8013b74308d58af88bc7dbb1b055c). The commit removes the vulnerable code path entirely. As no tagged release version is confirmed in available data, deploy directly from the fixed commit or later main branch until a versioned release is published. If immediate patching is not feasible, implement these compensating controls with noted trade-offs: (1) Disable the 'org_to_asn' transformer functionality if not operationally required - this prevents exploitation but removes legitimate OSINT analysis capability for AS number lookups. (2) Restrict network access to Flowsint to trusted internal networks only via firewall rules - eliminates remote attack vector but may hinder legitimate remote investigation workflows. (3) Implement strict input validation and allowlisting at the application perimeter for all sketch/node data - reduces attack surface but requires custom code changes and may break existing investigations with legitimate special characters. (4) Run Flowsint with enhanced container security policies (AppArmor, seccomp, read-only root filesystem) to prevent container escape - mitigates host compromise but does not prevent in-container RCE and may cause operational issues. All workarounds are inferior to patching; plan emergency maintenance window.