CVE-2026-42159— Flowsint: Stored XSS in description of node

Flowsint: Stored XSS in description of node

Flowsint is an open-source OSINT graph exploration tool designed for cybersecurity investigation, transparency, and verification. Prior to 1.2.3, Flowsint allows a user to create investigations, which are used to manage sketches and analyses. Sketches have controllable graphs, which are comprised of nodes and relationships. The sketches contain information on an OSINT target (usernames, websites, etc) within these nodes and relationships. A remote attacker can create a node with a malicious description that contains arbitrary HTML. When the node is selected, it will render the arbitrary HTML, potentially triggering stored XSS. This vulnerability is fixed in 1.2.3.

N/A

在Web页面生成时对输入的转义处理不恰当(跨站脚本)

Flowsint 跨站脚本漏洞

Flowsint是reconurge开源的一个开源情报图形化调查工具。 Flowsint 1.2.3之前版本存在跨站脚本漏洞，该漏洞源于节点描述包含任意HTML，可能导致远程攻击者创建包含恶意描述的节点，当节点被选中时渲染任意HTML，触发存储型跨站脚本。

N/A

N/A