Flowsint is an open‑source OSINT graph exploration tool that allows users to create and visualize nodes on a map. In versions prior to 1.2.3, a remote attacker who can submit data to the application can create a map node whose label field contains arbitrary HTML. When a user later selects the map tab and clicks on the node’s marker, the application renders that stored HTML, which can trigger a stored cross‑site scripting attack. This flaw enables an attacker to inject malicious scripts into the victim’s browser, potentially stealing credentials, hijacking sessions, or redirecting traffic.

The vulnerability affects the Flowsint tool from reconurge:flowsint for all releases older than 1.2.3. Any installation of Flowsint 1.2.2 or earlier that has not been updated is susceptible.

The CVSS score of 5.1 indicates moderate severity. Exploitation requires remote access to the web interface to create a malicious node and is activated when a user interacts with the map view. The EPSS score is not available and the flaw is not listed in the CISA KEV catalog, implying limited evidence of active exploitation today. Nevertheless, because stored XSS can lead to browser‑side compromise, the risk remains non‑trivial for users who regularly visit the affected map pages.