PT-2026-40948 · Flowsint · Flowsint

Sealldeveloper · Published 2026-05-14 · Updated 2026-05-14 · CVE-2026-42159

Positive Technologies (AI Summary)

CVSS v3.1

5.4

Medium

Base vector

AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N

Name of the Vulnerable Software and Affected Versions Flowsint versions prior to 1.2.3

Description Flowsint is an open-source OSINT graph exploration tool used for cybersecurity investigation, transparency, and verification. The software allows users to create investigations to manage sketches and analyses, where sketches consist of graphs containing nodes and relationships with target information. A remote attacker can create a node with a malicious description containing arbitrary HTML. When this node is selected, the HTML is rendered, which can trigger stored Cross-Site Scripting (XSS), a flaw where malicious scripts are permanently stored on the target server and executed in the victim's browser.

Recommendations Update to version 1.2.3.

Exploit

Fix

XSS

Weakness Enumeration

CWE-79

Related Identifiers

CVE-2026-42159

GHSA-W233-5MMX-CR7X

Affected Products

Flowsint

References · 5

• 🔥 https://github.com/reconurge/flowsint/security/advisories/GHSA-w233-5mmx-cr7x · Exploit
• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/42xxx/CVE-2026-42159.json · Exploit
• https://osv.dev/vulnerability/CVE-2026-42159 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2026-42159 · Security Note
• https://t.me/CVEtracker/53786 · Telegram Post