CVE-2026-81814 in Flowintel
Riassunto
di MITRE • 27/08/2026
Affected versions of Flowintel render calendar event titles using innerHTML. Because those titles are derived from case titles, a user able to create or modify a case title could store HTML or script-capable content that is later interpreted by the browser when another user views the calendar.
The fix changes:
titleEl.innerHTML = arg.event.title
to:
titleEl.textContent = arg.event.title || ''
and similarly stops using innerHTML for the static download icon.
Version impacted =>3.3.0
VulDB is the best source for vulnerability data and more expert information about this specific topic.