Flowsint is an open‑source OSINT graph exploration tool. Prior to version 1.2.3 a remote attacker can create a node whose type field is crafted to escape the surrounding Cypher query, allowing the attacker to execute an arbitrary Cypher statement against the backend graph database. This could lead to unauthorized reading, modification, or deletion of stored graph data, thereby affecting confidentiality, integrity, and availability of the information the tool manages.

The product reconurge:flowsint before version 1.2.3 is affected; the fix is provided in release 1.2.3 and later.

The CVSS base score is 7.1. EPSS data is not available, so the likelihood of exploitation remains uncertain, and the vulnerability is not listed in the CISA KEV catalog. Attackers can target the node‑creation API over the network; the description does not mention that authentication or privileged access is required, so a remote attacker able to reach the instance could craft the malicious request. The likely attack vector is remote network access to the API.