CVE-2026-81820
Severity CVSS v4.0:
MEDIUM
Type:
CWE-79
Cross-Site Scripting (XSS)
Publication date:
27/08/2026
Last modified:
27/08/2026
Description
Affected versions of Flowintel construct timeline HTML using attacker-controllable MISP object fields such as:<br />
<br />
<br />
<br />
* <br />
object UUID;<br />
<br />
<br />
* <br />
object name;<br />
<br />
<br />
* <br />
attribute value;<br />
<br />
<br />
* <br />
attribute type;<br />
<br />
<br />
* <br />
comment;<br />
<br />
<br />
* <br />
first/last seen values;<br />
<br />
<br />
* <br />
IDS flag.<br />
<br />
<br />
<br />
<br />
<br />
Those values were concatenated directly into HTML strings before rendering. The upstream commit explicitly states that DOMPurify removed XSS vectors but still allowed other HTML elements, such as forms, through.<br />
<br />
The fix replaces direct string interpolation with DOM construction via document.createElement() and assigns all attacker-controlled values using textContent. The headline is similarly converted to escaped HTML through a temporary element.<br />
<br />
Version impacted =>3.3.0
Impact
Base Score 4.0
5.10
Severity 4.0
MEDIUM