Is CVE-2026-42157 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-42157 being exploited in the wild.

How severe is CVE-2026-42157?

Informational severity, with a CVSS score of 5.1, published 12 May 2026.

Is there a fix for CVE-2026-42157?

A patch was published on 2026-05-12: Fix released in version 1.2.3 Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is CVE-2026-42157 attacked?

It is attacked over the network, in a network appliance.

Am I affected by CVE-2026-42157?

Check whether you run Reconurge Flowsint at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-42157: Reconurge Flowsint stored XSS in map node markers

CVE-2026-42157 · Severity: info · CVSS 5.1 · Published 2026-05-12

Flowsint is an open-source tool used by cybersecurity professionals to visualize and investigate data during digital investigations. A security flaw allows an attacker to inject malicious code into map markers within the application. If a user views a compromised map and clicks on a malicious marker, the attacker could potentially steal their login credentials or hijack their session, compromising the integrity of the investigation.

Technologies: Reconurge Flowsint. Vendors: Reconurge.

Quick answers

Is CVE-2026-42157 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-42157 being exploited in the wild.
How severe is CVE-2026-42157?: Informational severity, with a CVSS score of 5.1, published 12 May 2026.
Which products and versions are affected?: Reconurge Flowsint < 1.2.3.
Is there a fix for CVE-2026-42157?: A patch was published on 2026-05-12: Fix released in version 1.2.3 Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-42157 attacked?: It is attacked over the network, in a network appliance.
Am I affected by CVE-2026-42157?: Check whether you run Reconurge Flowsint at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

A stored cross-site scripting (XSS) vulnerability exists in Flowsint's map component. The root cause is located in 'flowsint-app/src/components/map/map.tsx', where the application uses Leaflet's 'bindPopup' method to render node labels or addresses. Because this method sets content using 'innerHTML' without proper sanitization, an attacker with permissions to create or modify nodes (via the /api/sketches/<sketch_id>/nodes/add endpoint) can inject arbitrary HTML/JavaScript. The payload executes in the context of any user who navigates to the map tab and clicks the affected marker. This can lead to the exfiltration of local storage data, including authorization tokens. The issue is resolved in version 1.2.3.

Affected products

reconurge Flowsint < 1.2.3

Timeline

2026-04-29: advisory: GitHub Security Advisory published by maintainer
2026-05-12: disclosed: CVE published to NVD
2026-05-12: patched: Fix released in version 1.2.3

References

https://github.com/reconurge/flowsint/security/advisories/GHSA-gj93-2vcq-729w

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.