Quick answers
- Is CVE-2026-81820 exploited in the wild?
- No. Junglewise Threat Intelligence has no report of CVE-2026-81820 being exploited in the wild.
- How severe is CVE-2026-81820?
- Informational severity, with a CVSS score of 5.4, published 27 August 2026.
- Which products and versions are affected?
- FlowIntel 3.3.0 and later.
- Is there a fix for CVE-2026-81820?
- A patch was published on 2026-08-24. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
- How is CVE-2026-81820 attacked?
- It is attacked over the network.
- Am I affected by CVE-2026-81820?
- Check whether you run FlowIntel at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.
Technical details
The vulnerability is an HTML injection / improper output encoding flaw in the timeline HTML construction logic (case_history.js). Affected versions concatenate attacker-controllable MISP object fields (object UUID, name, attribute values/types/comments, first/last seen, IDS flag) directly into HTML strings before rendering via DOMPurify. Although DOMPurify removes script tags and event handlers, it does not filter all dangerous HTML elements such as form elements, allowing an attacker to inject forms and other elements into the rendered timeline. The fix replaces string interpolation with DOM API methods (document.createElement and textContent), ensuring all user-controlled data is treated as text, not HTML. An attacker must be able to create or modify MISP objects within the intelligence platform to exploit this vulnerability; the attack is client-side and affects users viewing the malicious timeline data.
Affected products
- Flowintel Flowintel 3.3.0 and later
Timeline
- 2026-08-27: disclosed
- 2026-08-24: patched