EUVD-2026-67131
GHSA-cv7j-9q69-fxh4
Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:P/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Stored XSS via authenticated MISP field input (PR:L) requires a victim to view the timeline (UI:R); scope changes (S:C) to the victim browser enable cross-user HTML/form injection with low C and I impact.
Primary rating from Vendor (CIRCL).
CVSS VectorVendor: CIRCL
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:P/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Lifecycle Timeline
2DescriptionCVE.org
Affected versions of Flowintel construct timeline HTML using attacker-controllable MISP object fields such as:
* object UUID;
* object name;
* attribute value;
* attribute type;
* comment;
* first/last seen values;
* IDS flag.
Those values were concatenated directly into HTML strings before rendering. The upstream commit explicitly states that DOMPurify removed XSS vectors but still allowed other HTML elements, such as forms, through.
The fix replaces direct string interpolation with DOM construction via document.createElement() and assigns all attacker-controlled values using textContent. The headline is similarly converted to escaped HTML through a temporary element.
Version impacted =>3.3.0
AnalysisAI
Stored cross-site scripting in Flowintel's MISP timeline renderer allows an authenticated low-privileged attacker to inject arbitrary HTML into case timelines by supplying malicious content in MISP object fields - including UUID, object name, attribute values, types, comments, first/last seen timestamps, and IDS flags. These fields were concatenated directly into HTML strings without escaping; although DOMPurify was present, the upstream commit explicitly acknowledges it blocked script-based XSS vectors but still permitted other HTML elements such as forms to pass through. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Exploitation requires the attacker to hold an active Flowintel account with at least low-privilege access sufficient to create or modify MISP objects within a case - confirmed by PR:L in the CVSS 4.0 vector. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The CVSS 4.0 score of 5.1 (Medium) accurately reflects the realistic threat model: the attack is network-reachable with low complexity, but requires an authenticated low-privileged account (PR:L) and passive victim interaction to view the rendered timeline (UI:P). … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | An authenticated Flowintel user with case access creates or modifies a MISP object, embedding a malicious HTML form element inside a field such as `attribute.comment` or `attribute.value` - for example, a login-overlay form that submits captured credentials to an attacker-controlled endpoint. When a case analyst subsequently views the MISP timeline for that case, the injected form renders in their browser session because DOMPurify did not strip form elements, enabling credential phishing or session token capture within the application context. … |
| Remediation | The primary fix is to apply the upstream patch available at https://github.com/flowintel/flowintel/commit/11f71e747d95ed062667e2df0ce259c5fa64d531.patch, which replaces all HTML string interpolation in `app/static/js/case/case_history.js` with safe DOM construction using `document.createElement()` and `textContent` assignments. … Detailed patch versions, workarounds, and compensating controls in full report. |
Threat intelligence, references, and detailed analysis are available after sign-in.
Persistent session hijacking is possible in Flowintel version 3.3.0 and later because the application fails to invalidat
Privilege escalation in Flowintel's administrative user-edit API allows an organization administrator to modify full adm
Remote code execution in Flowintel's alerts settings update endpoint (versions >= 3.3.0) allows an authenticated high-pr
Remote code execution via log path traversal in Flowintel 3.3.0 and later is achievable by an authenticated administrato
Broken object-level authorization across Flowintel task endpoints allows authenticated editor-level users to perform una
Flowintel's PDF export pipeline passes attacker-controlled note content to Pandoc with the raw_tex extension enabled, al
Stored XSS via Vue template injection in FlowIntel allows an authenticated low-privilege user to persist malicious Vue i
Log injection in Flowintel versions 3.3.0 and later allows unauthenticated remote attackers to forge arbitrary log lines
Server-side request forgery in FlowIntel up to version 3.3.0 allows a low-privileged authenticated user to coerce the ap
Insufficient authorization on the Flowintel /my_assignment/user API endpoint allows any authenticated API user to retrie
Stored cross-site scripting in Flowintel's calendar view (versions >= 3.3.0) allows an authenticated user with case-crea
Stored cross-site scripting in Flowintel case notes allows an authenticated low-privileged user to inject malicious Java
Same weakness CWE-79 – Cross-site Scripting (XSS)
View allShare
External POC / Exploit Code
Leaving vuln.today