CVE-2026-42159 Details
Description
Flowsint is an open-source OSINT graph exploration tool designed for cybersecurity investigation, transparency, and verification. Prior to 1.2.3, Flowsint allows a user to create investigations, which are used to manage sketches and analyses. Sketches have controllable graphs, which are comprised of nodes and relationships. The sketches contain information on an OSINT target (usernames, websites, etc) within these nodes and relationships. A remote attacker can create a node with a malicious description that contains arbitrary HTML. When the node is selected, it will render the arbitrary HTML, potentially triggering stored XSS. This vulnerability is fixed in 1.2.3.
A stored cross-site scripting vulnerability has been identified in Flowsint versions prior to 1.2.3. Flowsint is an open-source OSINT graph exploration tool used for cybersecurity investigations. The vulnerability allows remote attackers to inject arbitrary HTML into the description of a node within an investigation. When the node is selected, the injected HTML is rendered, potentially executing malicious scripts. This issue arises because the application uses 'dangerouslySetInnerHTML' to display node descriptions, creating an opportunity for cross-site scripting attacks.
Users are advised to update Flowsint to version 1.2.3 or later.
Metrics
CVSS 4.0 Severity and Vector Strings:
CVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
CISA-ADP
Assessed May 14, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://github.com/reconurge/flowsint/security/advisories/GHSA-w233-5mmx-cr7x | CISA-ADP | ExploitVendor Advisory |
| https://github.com/reconurge/flowsint/security/advisories/GHSA-w233-5mmx-cr7x | [email protected] | ExploitVendor Advisory |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-79 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| flowsint flowsint | < 1.2.3 |
CPE
Remediation
| |
Change History
6 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Jun 17, 2026 | CVE Modified | [email protected] |
| Jun 17, 2026 | CVE Modified | CISA-ADP |
| May 21, 2026 | Reanalysis | [email protected] |
| May 21, 2026 | Initial Analysis | [email protected] |
| May 14, 2026 | CVE Modified | CISA-ADP |
| May 14, 2026 | New CVE Received | [email protected] |