Flowintel EUVD-2026-67131

Exploitation requires the attacker to hold an active Flowintel account with at least low-privilege access sufficient to create or modify MISP objects within a case - confirmed by PR:L in the CVSS 4.0 vector. A second prerequisite is that a victim user with a valid Flowintel browser session must passively view the MISP timeline rendering containing the attacker's object (UI:P in CVSS 4.0). The Flowintel instance must be integrated with MISP and the timeline feature must be actively used, as the vulnerable code path is the case_history.js timeline component. The attack is limited to HTML injection (including forms) rather than arbitrary JavaScript execution, because DOMPurify partially mitigated script-based vectors - full script-level XSS was not demonstrated per the upstream fix notes. No special non-default server configuration is required; the vulnerability exists in the default MISP timeline rendering path when objects with attacker-controlled fields are displayed.

The CVSS 4.0 score of 5.1 (Medium) accurately reflects the realistic threat model: the attack is network-reachable with low complexity, but requires an authenticated low-privileged account (PR:L) and passive victim interaction to view the rendered timeline (UI:P). Impact is bounded to low integrity on the vulnerable system (VI:L), with no confidentiality or availability impact, consistent with HTML injection rather than full script execution - DOMPurify's partial mitigation blocks pure script payloads, leaving form injection as the primary residual risk vector. In practice, form injection can enable in-application phishing, credential harvesting overlays, or CSRF-style manipulation for any analyst or case manager who views a compromised timeline. No EPSS data is available in the provided input, and the absence of a CISA KEV listing combined with no known public exploit code suggests this has not been exploited at scale. The real-world risk is most significant in environments where MISP object data originates from partially-trusted or external contributors, since the attack depends on an attacker controlling MISP object field content.

An authenticated Flowintel user with case access creates or modifies a MISP object, embedding a malicious HTML form element inside a field such as attribute.comment or attribute.value - for example, a login-overlay form that submits captured credentials to an attacker-controlled endpoint. When a case analyst subsequently views the MISP timeline for that case, the injected form renders in their browser session because DOMPurify did not strip form elements, enabling credential phishing or session token capture within the application context. No public exploit code has been identified at time of analysis, but the vulnerability is mechanically straightforward to reproduce given the direct field-to-HTML concatenation pattern documented in the commit diff.