CVE-2026-81820
Deferred Deferred - Pending Action

Stored XSS in Flowintel Timeline via MISP Object Fields

Publication date: 2026-08-27

Last updated on: 2026-08-27

Assigner: CIRCL

Description
Affected versions of Flowintel construct timeline HTML using attacker-controllable MISP object fields such as: * object UUID; * object name; * attribute value; * attribute type; * comment; * first/last seen values; * IDS flag. Those values were concatenated directly into HTML strings before rendering. The upstream commit explicitly states that DOMPurify removed XSS vectors but still allowed other HTML elements, such as forms, through. The fix replaces direct string interpolation with DOM construction via document.createElement() and assigns all attacker-controlled values using textContent. The headline is similarly converted to escaped HTML through a temporary element. Version impacted =>3.3.0

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-08-27
Last Modified
2026-08-27
Generated
2026-09-17
AI Q&A
2026-08-27
EPSS Evaluated
2026-09-15
NVD
CVE-2026-81820
EUVD
EUVD-2026-67131

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
flowintel flowintel 3.3.0

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-79 The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This vulnerability involves HTML injection in the Flowintel timeline feature. Attackers can inject malicious HTML elements like forms by exploiting MISP object fields such as UUID, name, attribute values, and comments. The issue arises because these fields were directly concatenated into HTML strings without proper sanitization, even after passing through DOMPurify.

Detection Guidance

Check for Flowintel versions greater than 3.3.0. Inspect timeline HTML generation in case_history.js for direct string interpolation of attacker-controlled fields like object UUID, name, or attribute values.

Impact Analysis

An attacker could craft malicious input to inject HTML elements like forms into the timeline, potentially leading to phishing attacks, data theft, or unauthorized actions. Users viewing the timeline might unknowingly interact with these elements, compromising their data or session.

Compliance Impact

This vulnerability could lead to data breaches or unauthorized access, violating GDPR's data protection principles and HIPAA's security requirements. Organizations may face compliance penalties if user data is compromised due to insufficient input sanitization.

Mitigation Strategies

Upgrade Flowintel to the patched version. Replace direct HTML string interpolation with DOM construction methods like document.createElement() and use textContent for all attacker-controlled values.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-81820. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart