FlowIntel renders user‑controlled values such as case titles, ticket identifiers, and organization names directly inside the DOM using Vue’s [[…]] interpolation delimiters. Normal HTML escaping does not remove Vue syntax, allowing an attacker to inject malicious Vue expressions that Vue evaluates when the page is rendered. The injected JavaScript runs in the victim’s browser under the FlowIntel origin, enabling data exfiltration, session hijacking, or modification of application data within the victim’s account privileges.

All FlowIntel installations, regardless of edition, are impacted because the flaw exists in the rendering of case, ticket, recurring‑case, profile, organization, and role fields. No fixed version range is provided, so the vulnerability remains present until the patch commit that adds the vue_escape filter is applied.

The vulnerability has a CVSS score of 6.9, indicating moderate‑high severity. EPSS data is not available, and the flaw is not yet listed in the CISA KEV catalog. Exploitation requires an authenticated user with permission to edit the affected fields, after which the malicious Vue expression is stored and later executed in any victim’s browser that views the altered content.