CVE-2026-81814 in Flowintel
Summary
by MITRE • 08/27/2026
Affected versions of Flowintel render calendar event titles using innerHTML. Because those titles are derived from case titles, a user able to create or modify a case title could store HTML or script-capable content that is later interpreted by the browser when another user views the calendar.
The fix changes:
titleEl.innerHTML = arg.event.title
to:
titleEl.textContent = arg.event.title || ''
and similarly stops using innerHTML for the static download icon.
Version impacted =>3.3.0
VulDB is the best source for vulnerability data and more expert information about this specific topic.
Analysis
by VulDB Data Team • 08/27/2026
Flowintel versions 3.3.0 and above are susceptible to a stored cross-site scripting vulnerability that arises from improper handling of user-supplied input within calendar event titles. The core technical flaw lies in the application's use of the innerHTML property for rendering text content directly into the Document Object Model without adequate sanitization or encoding. Specifically, when an administrator or authorized user creates or modifies a case title, this value is stored in the backend database and subsequently retrieved to populate calendar views. Because the frontend code assigns this string directly via innerHTML rather than using safer alternatives like textContent, any HTML tags or JavaScript event handlers embedded within the case title are executed by the browser of any other user who accesses that specific calendar view. This mechanism effectively transforms a simple data entry field into an attack vector for persistent malicious script execution across the application's interface.
The operational impact of this vulnerability is significant due to its stored nature, which distinguishes it from reflected XSS attacks where the payload must be triggered by a single interaction such as clicking a crafted link. In this scenario, once the attacker injects the malicious content into a case title, every subsequent user who views the calendar associated with that case will inadvertently execute the script in their own browser context. This allows for session hijacking through cookie theft, credential harvesting via keyloggers or form redirection, and potentially full account takeover if combined with other vulnerabilities like CSRF. Furthermore, because the payload is stored server-side, it persists until manually removed by an administrator, creating a long-term risk to all users of the platform rather than just the initial victim. The attack requires no special privileges beyond the ability to create or edit case titles, which may be available to various roles within the organization depending on their configuration.
From a standards perspective, this vulnerability aligns with CWE-79, commonly known as Improper Neutralization of Input During Web Page Generation, specifically under the subcategory for Cross-site Scripting (XSS). The failure to properly encode or escape user input before rendering it in an HTML context is the defining characteristic here. In terms of offensive security frameworks such as MITRE ATT&CK, this behavior facilitates techniques associated with Client-side Injection and potentially Account Manipulation if used to escalate privileges or maintain persistence within a compromised session. The vulnerability exploits the trust relationship between the application's frontend logic and its data sources, assuming that stored content is safe without verifying its structure against expected formats for plain text fields.
The remediation implemented in patched versions addresses this flaw by replacing innerHTML assignments with textContent properties. This change ensures that any HTML or script tags contained within the case title are treated as literal string characters rather than executable code elements, thereby neutralizing the injection vector entirely. The fix also extends to static UI elements such as download icons, ensuring consistency in security practices across all dynamic content rendering operations. To further mitigate risks associated with similar vulnerabilities, organizations should implement Content Security Policy headers that restrict script execution sources and disable inline scripts where possible. Additionally, adopting a whitelist-based approach for allowed HTML tags or utilizing robust sanitization libraries like DOMPurify can provide defense-in-depth against complex XSS payloads that might bypass simple text replacement strategies. Regular security audits focusing on input validation and output encoding practices are essential to prevent recurrence of such issues in web applications handling user-generated content.