CVE-2026-81820
Gravedad CVSS v4.0:
MEDIA
Tipo:
CWE-79
Neutralización incorrecta de la entrada durante la generación de la página web (Cross-site Scripting)
Fecha de publicación:
27/08/2026
Última modificación:
28/08/2026
Descripción
*** Pendiente de traducción *** Affected versions of Flowintel construct timeline HTML using attacker-controllable MISP object fields such as:<br />
<br />
<br />
<br />
* <br />
object UUID;<br />
<br />
<br />
* <br />
object name;<br />
<br />
<br />
* <br />
attribute value;<br />
<br />
<br />
* <br />
attribute type;<br />
<br />
<br />
* <br />
comment;<br />
<br />
<br />
* <br />
first/last seen values;<br />
<br />
<br />
* <br />
IDS flag.<br />
<br />
<br />
<br />
<br />
<br />
Those values were concatenated directly into HTML strings before rendering. The upstream commit explicitly states that DOMPurify removed XSS vectors but still allowed other HTML elements, such as forms, through.<br />
<br />
The fix replaces direct string interpolation with DOM construction via document.createElement() and assigns all attacker-controlled values using textContent. The headline is similarly converted to escaped HTML through a temporary element.<br />
<br />
Version impacted =>3.3.0
Impacto
Puntuación base 4.0
5.10
Gravedad 4.0
MEDIA