{"cve":"CVE-2026-81820","nvd":{"published":"2026-08-27T17:21:05.630","modified":"2026-08-28T15:28:32.763","status":"Deferred","description":"Affected versions of Flowintel construct timeline HTML using attacker-controllable MISP object fields such as:\n\n\n\n  *  \nobject UUID;\n\n\n  *  \nobject name;\n\n\n  *  \nattribute value;\n\n\n  *  \nattribute type;\n\n\n  *  \ncomment;\n\n\n  *  \nfirst/last seen values;\n\n\n  *  \nIDS flag.\n\n\n\n\n\nThose values were concatenated directly into HTML strings before rendering. The upstream commit explicitly states that DOMPurify removed XSS vectors but still allowed other HTML elements, such as forms, through.\n\nThe fix replaces direct string interpolation with DOM construction via document.createElement() and assigns all attacker-controlled values using textContent. The headline is similarly converted to escaped HTML through a temporary element.\n\nVersion impacted =>3.3.0","cvss_v4":{"vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:P/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N","score":5.1},"cvss_v3":null,"cwes":["CWE-79"],"references":["https://github.com/flowintel/flowintel/commit/11f71e747d95ed062667e2df0ce259c5fa64d531.patch"],"products":[],"source":"nvd","synced_at":"2026-10-19T22:50:17.453294893+00:00"},"epss":{"cve":"CVE-2026-81820","score":0.0039,"percentile":0.33122,"date":"2026-10-31"},"kev":null,"osv":[],"attribution":["This product uses the NVD API but is not endorsed or certified by the NVD.","EPSS scores: FIRST Exploit Prediction Scoring System, https://www.first.org/epss","Known exploited vulnerabilities: CISA Known Exploited Vulnerabilities Catalog, https://www.cisa.gov/known-exploited-vulnerabilities-catalog","Package advisories: OSV (https://osv.dev), from the GitHub Advisory Database, PyPA, Go, RustSec and other ecosystem databases, under CC-BY 4.0 or CC0","CVE records: the CVE Program's CVE List (https://www.cve.org), under its terms of use (https://www.cve.org/Legal/TermsOfUse). CVE is a registered trademark of The MITRE Corporation; this product is not affiliated with the CVE Program."]}