CVE-2026-81820: Flowintel HTML Injection in MISP Case History Timeline via Crafted Object Attributes
Affected versions of Flowintel construct timeline HTML using attacker-controllable MISP object fields such as:
object UUID;
object name;
attribute value;
attribute type;
comment;
first/last seen values;
IDS flag.
Those values were concatenated directly into HTML strings before rendering. The upstream commit explicitly states that DOMPurify removed XSS vectors but still allowed other HTML elements, such as forms, through.
The fix replaces direct string interpolation with DOM construction via document.createElement() and assigns all attacker-controlled values using textContent. The headline is similarly converted to escaped HTML through a temporary element.
Version impacted =>3.3.0
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
Flowintel construct timeline HTMLto a version that resolves this vulnerability.Fixed in 3.3.0 - Configuration
Update Flowintel’s timeline HTML construction to replace direct string interpolation/HTML concatenation with DOM construction using document.createElement(), and set attacker-controlled fields (e.g., MISP object attribute type, attribute value, comment, first/last seen values, object UUID, object name) via textContent. Convert the headline to escaped HTML via a temporary element (as described), rather than inserting raw HTML.
Flowintel case history timeline rendering string interpolation vs DOM construction = Use document.createElement() and assign attacker-controlled values via textContent instead of concatenating into HTML strings
Event History
Frequently Asked Questions
Which deployments are affected?
Flowintel versions up to and including 3.3.0 are impacted. The vulnerable timeline rendering handles MISP object fields, so deployments that display MISP case-history timeline data are exposed to attacker-controlled content.
What does an attacker need to exploit this issue?
An attacker needs to control values in MISP object fields rendered in the timeline, including object UUID or name, attribute values or types, comments, first/last seen values, or the IDS flag. Those values were previously inserted directly into generated HTML.
What should be done if patching is not immediately possible?
Avoid rendering timeline entries containing untrusted MISP object data until the fix can be applied. Sanitization relying only on DOMPurify was not sufficient here because the upstream commit notes that some HTML elements, including forms, could still be allowed.
How can administrators determine whether they are affected?
Check the deployed Flowintel version; versions at or below 3.3.0 are affected. Review whether case-history timelines render MISP object attributes, particularly where those fields may be supplied by untrusted sources.