Executive brief
Flowintel is an intelligence platform that visualizes MISP (Malware Information Sharing Platform) object data in interactive timelines. An attacker who can control MISP object fields (name, attributes, comments, dates) can inject arbitrary HTML elements—including forms and other interactive content—that execute in users' browsers when the timeline is rendered. While basic scripting is blocked, an attacker could create convincing phishing forms or other HTML-based attacks embedded directly in the timeline view.
Technical details
The vulnerability is an HTML injection / improper output encoding flaw in the timeline HTML construction logic (case_history.js). Affected versions concatenate attacker-controllable MISP object fields (object UUID, name, attribute values/types/comments, first/last seen, IDS flag) directly into HTML strings before rendering via DOMPurify. Although DOMPurify removes script tags and event handlers, it does not filter all dangerous HTML elements such as form elements, allowing an attacker to inject forms and other elements into the rendered timeline. The fix replaces string interpolation with DOM API methods (document.createElement and textContent), ensuring all user-controlled data is treated as text, not HTML. An attacker must be able to create or modify MISP objects within the intelligence platform to exploit this vulnerability; the attack is client-side and affects users viewing the malicious timeline data.
Affected products
- Flowintel Flowintel 3.3.0 and later
Timeline
- 2026-08-27: disclosed
- 2026-08-24: patched