CVE-2026-81820 in Flowintel
Summary
by MITRE • 08/27/2026
Affected versions of Flowintel construct timeline HTML using attacker-controllable MISP object fields such as:
* object UUID;
* object name;
* attribute value;
* attribute type;
* comment;
* first/last seen values;
* IDS flag.
Those values were concatenated directly into HTML strings before rendering. The upstream commit explicitly states that DOMPurify removed XSS vectors but still allowed other HTML elements, such as forms, through.
The fix replaces direct string interpolation with DOM construction via document.createElement() and assigns all attacker-controlled values using textContent. The headline is similarly converted to escaped HTML through a temporary element.
Version impacted =>3.3.0
VulDB is the best source for vulnerability data and more expert information about this specific topic.
Analysis
by VulDB Data Team • 08/27/2026
Flowintel versions 3.3.0 and later are susceptible to Cross-Site Scripting vulnerabilities arising from the insecure construction of timeline HTML pages. This vulnerability stems from the direct concatenation of attacker-controllable fields derived from MISP objects into raw HTML strings prior to rendering in a web browser context. The specific data points that serve as injection vectors include object UUID, object name, attribute value, attribute type, comment, first and last seen timestamps, and IDS flags. Because these values are sourced from external threat intelligence feeds managed by potentially malicious actors or compromised systems within the MISP ecosystem, an adversary can inject arbitrary JavaScript payloads into any of these fields. When Flowintel processes this data to generate a visual timeline for analysis, it fails to adequately sanitize or escape these inputs before embedding them in the DOM structure intended for display.
The root cause of this flaw lies in the application's reliance on string interpolation rather than secure DOM manipulation techniques. While upstream efforts attempted to mitigate risks by integrating DOMPurify, the configuration used was insufficiently restrictive. The library removed known XSS vectors but inadvertently allowed other dangerous HTML elements such as forms and scripts to pass through if they were not explicitly blocked or properly escaped in this specific context. This partial sanitization creates a false sense of security, allowing sophisticated attackers to bypass basic filters by leveraging alternative injection techniques that exploit the remaining permissive parsing rules. Consequently, any user viewing the generated timeline page will execute malicious code within their browser session under the authority of the Flowintel application's origin.
The operational impact of this vulnerability is severe, as it enables stored Cross-Site Scripting attacks. Since the vulnerable data originates from MISP objects which are often curated and shared across organizations, a single compromised or maliciously crafted object can propagate XSS payloads to multiple users accessing their respective timelines. Successful exploitation allows an attacker to steal session cookies, hijack user sessions, perform actions on behalf of authenticated users, or redirect victims to phishing sites. In the context of threat intelligence platforms where high-privilege analysts frequently interact with detailed data views, this vulnerability could lead to full account compromise and subsequent lateral movement within the organization's security infrastructure. The attack aligns with MITRE ATT&CK technique T1059 Command and Scripting Interpreter, specifically through browser-based execution via HTML/Script tags injected into web content.
To mitigate this risk, immediate remediation is required by upgrading to a patched version of Flowintel that implements secure DOM construction practices. The fix involves replacing direct string interpolation with the use of document.createElement() for building HTML structures and assigning all user-controlled values exclusively through textContent properties. This approach ensures that any special characters in attacker-supplied data are treated as plain text rather than executable code or structural HTML elements. Additionally, headlines should be converted to escaped HTML via a temporary element before insertion into the DOM. Organizations relying on affected versions must also enforce strict validation and sanitization of incoming MISP object fields at the ingestion layer where possible, ensuring that only expected character sets are permitted in critical display fields like comments and attribute values until the software update is applied. This vulnerability corresponds to CWE-79 Improper Neutralization of Input During Web Page Generation commonly known as Cross-site Scripting.