Flowsint, an open‑source OSINT graph exploration tool, allows users to create investigations that contain sketches made of nodes and relationships. Prior to version 1.2.3 a malicious user can create a node whose description field contains arbitrary HTML. When that node is selected the embedded HTML is rendered in the browser, which can lead to execution of attacker‑supplied scripts. This is a classic Stored Cross‑Site Scripting vulnerability (CWE‑79), compromising the confidentiality and integrity of the data viewed by others who interact with the compromised node.

The vulnerability affects the reconurge Flowsint project. All releases of Flowsint older than version 1.2.3 are susceptible. Users running any of those vulnerable versions are at risk when they allow untrusted users to create or edit node descriptions.

The CVSS score of 5.3 indicates a medium severity vulnerability. No EPSS score is available and the vulnerability is not listed in the CISA KEV catalog. An attacker who can supply a node with a malicious description can trigger stored XSS by having another user view that node. The risk is limited to environments where the graph is shared or accessed by others, but the potential impact is the injection of arbitrary scripts in the client browser.