Which versions of Flowsint are affected by CVE-2026-42156?

Flowsint, an open-source graph-exploration tool for OSINT operations, contains a Cypher query injection vulnerability affecting all versions before 1.2.3 that allows authenticated users to execute…

How to fix or mitigate CVE-2026-42156?

Within 24 hours, identify all Flowsint instances in the environment, document their version numbers and the data they expose, and assess whether any store sensitive or operational data. Within 7 days, restrict Flowsint access to high-trust users only, implement strict database query logging at the Neo4j/backend layer, and validate that no unauthorized accounts have been created; if the tool is non-critical, consider taking it offline pending a fix. Within 30 days, coordinate with the Flowsint project maintainers to confirm whether version 1.2.3 or later will include a patch; if mitigation is not expected, plan a replacement graph-exploration tool or implement custom input sanitization at the application layer as a stop-gap.

Flowsint CVE-2026-42156

Q: What is the CVSS score of CVE-2026-42156?

CVE-2026-42156 has a CVSS 4.0 base score of 7.1 (High). CVSS vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.2%.

HIGH

Improper Neutralization of Special Elements in Data Query Logic (CWE-943)

2026-05-12 security-advisories@github.com

Information Disclosure Nosql Injection

7.1

CVSS 4.0 · GitHub Advisory

Severity by source

GitHub Advisory PRIMARY

7.1 HIGH

CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

vuln.today AI

8.3 HIGH

Network-reachable with only a low-privilege account (PR:L) and no interaction; arbitrary Cypher execution realistically enables data read (C:H) and modification/deletion (I:H, A:L), broader than the vendor's confidentiality-only scoping.

3.1 AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:L

4.0 AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:L/SC:N/SI:N/SA:N

Primary rating from GitHub Advisory.

CVSS VectorGitHub Advisory

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Lifecycle Timeline

Analysis Generated

Jul 23, 2026 - 19:04 vuln.today

CVE Published

May 12, 2026 - 23:16 nvd

HIGH 7.1

DescriptionGitHub Advisory

Flowsint is an open-source OSINT graph exploration tool designed for cybersecurity investigation, transparency, and verification. Prior to 1.2.3, a remote attacker can create a node with a malicious type that can escape an existing Cypher query and an adversary can execute an arbitrary Cypher query. This vulnerability is fixed in 1.2.3.

AnalysisAI

Cypher query injection in Flowsint, an open-source OSINT graph-exploration tool, allows an authenticated remote attacker to break out of an application-generated Cypher statement and run arbitrary queries against the backing graph database. By creating a node whose 'type' value contains malicious Cypher syntax, the attacker escapes the intended query context (CWE-943) and can read or manipulate arbitrary graph data. Publicly available exploit code exists per the CISA SSVC assessment; the flaw affects all versions prior to 1.2.3 and is not currently listed in CISA KEV.

Technical ContextAI

Flowsint stores and explores OSINT investigation data as a graph, which in practice is queried through Cypher - the declarative query language used by Neo4j-style graph databases. The vulnerability is a classic query-language injection (CWE-943, Improper Neutralization of Special Elements Used in a Data Query Logic) in which user-controlled input (a node's 'type' attribute) is concatenated into a Cypher statement without proper parameterization or neutralization. Because Cypher supports full read and write operations (MATCH, CREATE, SET, DELETE, and clause chaining), an attacker who can inject syntax into one statement can append or terminate clauses to execute entirely attacker-defined queries. The GitHub Security Advisory GHSA-h5m2-c2c5-968p is the sole authoritative source; no CPE strings were provided in the intelligence set, so exact affected package/platform identifiers are not independently confirmed beyond the 'prior to 1.2.3' version boundary.

Affected ProductsAI

Flowsint, the open-source OSINT graph exploration tool by the 'reconurge' project, is affected in all versions prior to 1.2.3. The vendor advisory is GitHub Security Advisory GHSA-h5m2-c2c5-968p (https://github.com/reconurge/flowsint/security/advisories/GHSA-h5m2-c2c5-968p). No CPE identifiers were supplied in the source data, so the affected component boundary is defined only by the '< 1.2.3' version range from the advisory and NVD.

RemediationAI

Vendor-released patch: upgrade Flowsint to version 1.2.3 or later, which fixes the Cypher injection per GitHub Security Advisory GHSA-h5m2-c2c5-968p (https://github.com/reconurge/flowsint/security/advisories/GHSA-h5m2-c2c5-968p). If immediate upgrade is not possible, restrict who can authenticate to and create nodes in the application, since exploitation requires an authenticated account (PR:L) - limiting node-creation privileges to trusted users reduces exposure at the cost of collaboration flexibility. Additionally, place the application behind network access controls (VPN or IP allowlist) so the network-reachable endpoint is not broadly exposed, and, if operationally feasible, run the backing graph database with a least-privileged application account so injected queries cannot exceed the app's intended data scope; note these are compensating controls only and do not remove the underlying injection flaw.