Quick answers
- Is CVE-2026-81659 exploited in the wild?
- No. Junglewise Threat Intelligence has no report of CVE-2026-81659 being exploited in the wild.
- How severe is CVE-2026-81659?
- Informational severity, with a CVSS score of 0, published 27 August 2026.
- Which products and versions are affected?
- FlowIntel prior to commit 16f618fa36a72c4c5ca3ff0abf7dd67455318ef1.
- Is there a fix for CVE-2026-81659?
- A patch was published on 2026-08-12: Security fix merged in commits 16f618f and 2ba9700 on GitHub Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
- How is CVE-2026-81659 attacked?
- It is attacked over the network.
- Am I affected by CVE-2026-81659?
- Check whether you run FlowIntel at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.
Technical details
The vulnerability is an arbitrary file read flaw in Flowintel's PDF export functionality. When user-controlled note content is processed by Pandoc and XeLaTeX without proper sanitization, an attacker can craft malicious markdown/LaTeX that instructs these tools to read files from the server filesystem and include them in the generated PDF. The attack is triggered when a user (or an attacker with access to create notes) exports a note to PDF. The vulnerable code did not properly restrict or escape content before passing it to Pandoc with raw LaTeX/HTML processing enabled. The fix involves adding restrictions to the Pandoc markdown format configuration and sanitizing input before export.
Affected products
- Flowintel Flowintel prior to commit 16f618fa36a72c4c5ca3ff0abf7dd67455318ef1
Timeline
- 2026-08-27: disclosed
- 2026-08-12: patched: Security fix merged in commits 16f618f and 2ba9700 on GitHub