# CVE-2026-81820: Flowintel HTML injection in MISP object timeline

Source: https://junglewise.ai/threats/cve-2026-81820-flowintel-html-injection-in-misp-object-timeline  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-08-27. Updated: 2026-09-25  
License: CC BY 4.0 with a link back

CVE-2026-81820 · Severity: info · CVSS 5.4 · Published 2026-08-27

Flowintel is an intelligence platform that visualizes MISP (Malware Information Sharing Platform) object data in interactive timelines. An attacker who can control MISP object fields (name, attributes, comments, dates) can inject arbitrary HTML elements—including forms and other interactive content—that execute in users' browsers when the timeline is rendered. While basic scripting is blocked, an attacker could create convincing phishing forms or other HTML-based attacks embedded directly in the timeline view.

Technologies: [FlowIntel](https://junglewise.ai/threats/technologies/flowintel). Vendors: [FlowIntel](https://junglewise.ai/threats/vendors/flowintel).

## Quick answers

**Is CVE-2026-81820 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-81820 being exploited in the wild.

**How severe is CVE-2026-81820?** Informational severity, with a CVSS score of 5.4, published 27 August 2026.

**Which products and versions are affected?** FlowIntel 3.3.0 and later.

**Is there a fix for CVE-2026-81820?** A patch was published on 2026-08-24. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-81820 attacked?** It is attacked over the network.

**Am I affected by CVE-2026-81820?** Check whether you run FlowIntel at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

The vulnerability is an HTML injection / improper output encoding flaw in the timeline HTML construction logic (case_history.js). Affected versions concatenate attacker-controllable MISP object fields (object UUID, name, attribute values/types/comments, first/last seen, IDS flag) directly into HTML strings before rendering via DOMPurify. Although DOMPurify removes script tags and event handlers, it does not filter all dangerous HTML elements such as form elements, allowing an attacker to inject forms and other elements into the rendered timeline. The fix replaces string interpolation with DOM API methods (document.createElement and textContent), ensuring all user-controlled data is treated as text, not HTML. An attacker must be able to create or modify MISP objects within the intelligence platform to exploit this vulnerability; the attack is client-side and affects users viewing the malicious timeline data.

## Affected products

- Flowintel Flowintel 3.3.0 and later

## Timeline

- 2026-08-27: disclosed
- 2026-08-24: patched

## References

- [https://github.com/flowintel/flowintel/commit/11f71e747d95ed062667e2df0ce259c5fa64d531.patch](https://github.com/flowintel/flowintel/commit/11f71e747d95ed062667e2df0ce259c5fa64d531.patch)

## Related threats

- [flowintel SQL injection in database migration script](https://junglewise.ai/threats/cve-2026-124850-a-sql-injection-vulnerability-exists-in-a-database-migration)
- [Flowintel login email validation bypass leading to log injection](https://junglewise.ai/threats/cve-2026-81827-flowintel-login-email-validation-bypass-leading-to-log-injection)
- [Flowintel session fixation after password change](https://junglewise.ai/threats/cve-2026-81826-flowintel-session-fixation-after-password-change)
- [Flowintel unauthorized cross-user assignment access](https://junglewise.ai/threats/cve-2026-81819-flowintel-unauthorized-cross-user-assignment-access)
- [Flowintel authorization bypass in user-edit API](https://junglewise.ai/threats/cve-2026-81818-flowintel-authorization-bypass-in-user-edit-api)