Executive brief
Flowsint, an open-source tool used for cybersecurity investigations and OSINT graph analysis, is vulnerable to a security flaw that allows attackers to inject malicious code into investigation data. By creating a graph node with a specially crafted description, an attacker can execute scripts in the browser of another user who views that node. This could lead to the theft of sensitive session tokens or unauthorized access to investigation data if the tool is used in a collaborative environment.
Technical details
A stored cross-site scripting (XSS) vulnerability exists in Flowsint prior to version 1.2.3. The vulnerability is located in 'flowsint-app/src/components/graphs/details-panel/details-panel.tsx', where the application uses 'dangerouslySetInnerHTML' to render node descriptions without proper sanitization. An attacker with the ability to create or modify nodes via the '/api/sketches/<sketch_id>/nodes/add' endpoint can inject arbitrary HTML/JavaScript. When a victim selects the compromised node in the graph UI, the payload executes in their browser context. This can be used to exfiltrate local storage data, including authorization tokens, potentially leading to session hijacking. The issue is fixed in version 1.2.3.
Affected products
- Reconurge Flowsint < 1.2.3
Timeline
- 2026-04-30: advisory: GitHub Security Advisory published by maintainers.
- 2026-05-14: disclosed: CVE-2026-42159 published.
- 2026-05-14: patched: Fix released in version 1.2.3.