Flowsint CVE-2026-42157
MEDIUMSeverity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:P/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Network-reachable stored XSS requiring a low-privilege account (PR:L) and victim click (UI:R); scope changes to victim browser context (S:C); no availability impact.
Primary rating from GitHub Advisory.
CVSS VectorGitHub Advisory
Lifecycle Timeline
2DescriptionGitHub Advisory
Flowsint is an open-source OSINT graph exploration tool designed for cybersecurity investigation, transparency, and verification. Prior to 1.2.3, a remote attacker can create a map node with a malicious label that contains arbitrary HTML. When the map tab is selected and a map node marker is selected, it will render the arbitrary HTML, potentially triggering stored XSS. This vulnerability is fixed in 1.2.3.
AnalysisAI
Stored cross-site scripting in Flowsint, an open-source OSINT graph exploration tool, allows an authenticated remote attacker to inject arbitrary HTML into map node labels that executes in the browser of any user who selects that node marker in the map tab. Affected versions are all releases prior to 1.2.3, which delivers the official fix. Publicly available exploit code exists per SSVC data, though EPSS sits at just 0.16% (37th percentile), consistent with the tool's niche deployment footprint and the non-automatable nature of the attack.
Technical ContextAI
Flowsint is a web-based graph exploration platform where cybersecurity investigators create maps composed of nodes with user-supplied labels. The root cause is CWE-79 (Improper Neutralization of Input During Web Page Generation): the application fails to sanitize or escape HTML metacharacters in map node label fields before rendering them in the DOM when a user selects a node marker on the map tab. The CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:L/UI:P) confirms the exploit path: network-reachable, low complexity, requires a low-privileged account to write the payload, and requires a second user to interact with the poisoned node to trigger execution. No CPE strings were provided in the source intelligence; affected scope is described solely as all Flowsint releases prior to version 1.2.3.
Affected ProductsAI
All versions of Flowsint prior to 1.2.3 are affected. Flowsint is an open-source project maintained at github.com/reconurge/flowsint. No CPE strings were included in the available intelligence data; the affected version range is derived exclusively from the vendor security advisory at https://github.com/reconurge/flowsint/security/advisories/GHSA-gj93-2vcq-729w. No third-party distributions or downstream packages were identified in the provided data.
RemediationAI
Upgrade Flowsint to version 1.2.3 or later, which resolves the vulnerability per the vendor advisory at https://github.com/reconurge/flowsint/security/advisories/GHSA-gj93-2vcq-729w. If an immediate upgrade is not feasible, administrators should restrict map node creation and editing permissions to the minimum set of trusted users, since the attack requires an authenticated account capable of writing node labels - reducing this population directly limits exposure. As an additional compensating control, deploying a strict Content Security Policy (CSP) at the reverse proxy or web server layer (e.g., script-src 'self') can neutralize the impact of injected scripts even if the label is rendered unsanitized; note that an overly restrictive CSP may break legitimate application functionality and should be tested before deployment. Neither compensating control is a substitute for patching.
Same weakness CWE-79 – Cross-site Scripting (XSS)
View allShare
External POC / Exploit Code
Leaving vuln.today