CVE-2026-42159: falha de média gravidade em reconurge flowsint
Flowsint: Stored XSS in description of node
Publicada em
Aviso por e-mail quando ela entrar no KEV, ganhar PoC pública ou subir de nota.
13Vexday Risk Score
Sem sinal de exploração. Nenhum artefato público de exploração conhecido até agora.
ssvc Trackcvss 5.3epss 0.2%
Flowsint is an open-source OSINT graph exploration tool designed for cybersecurity investigation, transparency, and verification. Prior to 1.2.3, Flowsint allows a user to create investigations, which are used to manage sketches and analyses. Sketches have controllable graphs, which are comprised of nodes and relationships. The sketches contain information on an OSINT target (usernames, websites, etc) within these nodes and relationships. A remote attacker can create a node with a malicious description that contains arbitrary HTML. When the node is selected, it will render the arbitrary HTML, potentially triggering stored XSS. This vulnerability is fixed in 1.2.3.
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N
Produtos afetados
reconurge · flowsintCVEs relacionadas — reconurge flowsint
No mesmo produto, das mais perigosas para as menos.
CVE-2026-32311CRITICALCommand Injection and Docker container escape allows root on host machineEPSS 0.5%CVE-2026-42156HIGHFlowsint: Cypher query injection in node type on node creationEPSS 0.3%CVE-2026-42157MEDIUMFlowsint: Stored XSS on map node marker in map pageEPSS 0.3%CVE-2026-44352MEDIUMFlowsint: Broken Access Control allows reading of sketch logs from any userEPSS 0.3%CVE-2026-42158LOWFlowsint: Broken Access Control allows modification of investigation metadata from any userEPSS 0.2%