The Flowintel platform builds a timeline view by concatenating attacker‑controlled MISP object fields—such as UUID, name, value, type, comment, and timestamps—directly into HTML strings. Because DOMPurify was configured to remove basic XSS vectors but still allowed generic HTML elements, this approach enabled an attacker to inject arbitrary markup or JavaScript. The flaw was present only in versions before 3.3.0, after which the codebase switched to creating DOM elements and setting textContent to avoid unsanitized output.

Any Flowintel installation that uses a timeline view and runs a Flowintel component older than 3.3.0 is affected. The vendor is Flowintel and the vulnerable code path is the case‑history timeline rendering logic.

The CVSS score of 5.1 indicates a moderate severity. No EPSS value is provided, suggesting the risk of exploitation is presently low to moderate, and the vulnerability is not listed in the CISA KEV catalog, meaning no widespread active exploitation is known. Attackers would deliver malicious payloads by creating or injecting crafted MISP objects that the affected system will render in a user’s browser, making the attack vector client‑side and dependent on users viewing the timeline.