CVE-2026-81820

Name of the Vulnerable Software and Affected Versions Flowintel versions 3.3.0 and later

Description Flowintel constructs timeline HTML by directly concatenating attacker-controllable MISP object fields into HTML strings before rendering. The affected fields include the object UUID, object name, attribute value, attribute type, comment, first/last seen values, and IDS flag. Although DOMPurify was used to remove XSS vectors, other HTML elements, such as forms, were still permitted, leading to HTML injection.

Recommendations For versions 3.3.0 and later, update the software to a version where direct string interpolation is replaced with DOM construction via document.createElement() and attacker-controlled values are assigned using textContent.