CVE-2026-42159: Reconurge Flowsint stored XSS in node description

CVE-2026-42159 · Severity: medium · CVSS 5.4 · Published 2026-05-14

Flowsint, an open-source tool used for cybersecurity investigations and OSINT graph analysis, is vulnerable to a security flaw that allows attackers to inject malicious code into investigation data. By creating a graph node with a specially crafted description, an attacker can execute scripts in the browser of another user who views that node. This could lead to the theft of sensitive session tokens or unauthorized access to investigation data if the tool is used in a collaborative environment.

Technologies: Reconurge Flowsint. Vendors: Reconurge.

Quick answers

Is CVE-2026-42159 exploited in the wild?
No. Junglewise Threat Intelligence has no report of CVE-2026-42159 being exploited in the wild.
How severe is CVE-2026-42159?
Medium severity, with a CVSS score of 5.4, published 14 May 2026.
Which products and versions are affected?
Reconurge Flowsint < 1.2.3.
Is there a fix for CVE-2026-42159?
A patch was published on 2026-05-14: Fix released in version 1.2.3. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-42159 attacked?
It is attacked over the network, in a network appliance.
Am I affected by CVE-2026-42159?
Check whether you run Reconurge Flowsint at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

A stored cross-site scripting (XSS) vulnerability exists in Flowsint prior to version 1.2.3. The vulnerability is located in 'flowsint-app/src/components/graphs/details-panel/details-panel.tsx', where the application uses 'dangerouslySetInnerHTML' to render node descriptions without proper sanitization. An attacker with the ability to create or modify nodes via the '/api/sketches/<sketch_id>/nodes/add' endpoint can inject arbitrary HTML/JavaScript. When a victim selects the compromised node in the graph UI, the payload executes in their browser context. This can be used to exfiltrate local storage data, including authorization tokens, potentially leading to session hijacking. The issue is fixed in version 1.2.3.

Affected products

  • Reconurge Flowsint < 1.2.3

Timeline

  • 2026-04-30: advisory: GitHub Security Advisory published by maintainers.
  • 2026-05-14: disclosed: CVE-2026-42159 published.
  • 2026-05-14: patched: Fix released in version 1.2.3.

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.