The vulnerability arises when Flowintel renders Mermaid diagram blocks that are stored in case notes without escaping potentially malicious markup. A user who can create or edit a case note can embed a Mermaid diagram containing arbitrary JavaScript. When another authenticated user opens the affected note, the browser executes that code, enabling the attacker to run script in the victim’s context.

Flowintel versions 3.3.0 and later are affected. Any installation that allows users to add or modify case notes is susceptible, and every user who views an unpatched note is exposed to the flaw.

The CVSS score of 5.1 indicates moderate severity. EPSS data is not available, and the issue is not listed in CISA’s KEV catalog, suggesting limited known exploitation. An attacker with note‑editing rights can inject malicious Mermaid content that will be executed client‑side in browsers of users who view the note. The attack vector requires that the attacker can create or edit a note; no additional network or privilege escalation is needed.