CVE-2026-81814: Flowintel Stored XSS in Calendar via Malicious Case Title
Affected versions of Flowintel render calendar event titles using innerHTML. Because those titles are derived from case titles, a user able to create or modify a case title could store HTML or script-capable content that is later interpreted by the browser when another user views the calendar.
The fix changes:
titleEl.innerHTML = arg.event.title
to:
titleEl.textContent = arg.event.title || ''
and similarly stops using innerHTML for the static download icon.
Version impacted =>3.3.0
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
Flowintelto a version that resolves this vulnerability.Fixed in 3.3.0 - Configuration
Update Flowintel so calendar event titles are rendered with titleEl.textContent = arg.event.title || '' instead of titleEl.innerHTML = arg.event.title to prevent Stored XSS via malicious case titles. Also apply the same change for the static download icon to stop using innerHTML.
Flowintel calendar event title rendering innerHTML usage (titleEl.innerHTML) = replaced with textContent (titleEl.textContent = arg.event.title || '')
Event History
Frequently Asked Questions
Who can trigger the issue, and who is exposed to the stored payload?
Any user who can create or modify a case title can store malicious HTML or script-capable content. Users who later view the calendar where the associated event title is rendered may be exposed.
Which versions are affected?
Flowintel versions up to and including 3.3.0 are impacted.
What should be changed if applying the fix is not immediately possible?
Restrict case-title creation and modification to trusted users, and review existing case titles for HTML or script-capable content. The vulnerable behavior is caused by rendering event titles with innerHTML; the fix uses textContent instead.