PatchSiren

PatchSiren cyber security CVE debrief

CVE-2026-42159 reconurge CVE debrief

CVE-2026-42159 affects Flowsint prior to 1.2.3. According to the NVD record and the linked GitHub advisory, a remote attacker can create a node with a malicious description containing arbitrary HTML. When another user selects that node, the HTML is rendered and may trigger stored cross-site scripting. The issue is rated medium severity (CVSS 5.3) and is fixed in Flowsint 1.2.3.

Vendor
reconurge
Product
flowsint
CVSS
MEDIUM 5.3
CISA KEV
Not listed in stored evidence
Original CVE published
2026-05-14
Original CVE updated
2026-05-21
Advisory published
2026-05-14
Advisory updated
2026-05-21

Who should care

Flowsint administrators, security teams, and analysts who create, share, or review investigations and sketches should treat this as relevant, especially in collaborative or multi-user environments where untrusted content can be introduced into node descriptions.

Technical summary

The vulnerable behavior is in node rendering: descriptions can include attacker-controlled HTML, and selecting the node causes that content to be rendered in the UI. The result is a stored XSS condition (CWE-79) with network attack vector and required user interaction. NVD lists Flowsint versions before 1.2.3 as affected; the vendor advisory identifies the fix in 1.2.3.

Defensive priority

Medium priority. Patch before further use of affected versions, especially if Flowsint is exposed to multiple users or accepts imported, shared, or externally sourced investigation content.

Recommended defensive actions

  • Upgrade Flowsint to version 1.2.3 or later.
  • Review any workflows that allow untrusted users or imported data to populate node descriptions.
  • Treat existing investigation content as potentially tainted until validated and sanitized.
  • If upgrading is delayed, restrict access to affected instances and limit who can create or edit sketches.
  • Use the linked vendor advisory and NVD record to verify remediation status and affected versions.

Evidence notes

The CVE record was published on 2026-05-14 and last modified on 2026-05-21. NVD marks the vulnerability status as Analyzed and lists Flowsint versions before 1.2.3 as vulnerable. The advisory reference on GitHub is the primary vendor-linked source and identifies CWE-79. The provided CVSS v4.0 vector reflects network-reachable impact with user interaction required.

Sources and references

Verified primary and authoritative sources

  • CVE-2026-42159 CVE Program record

    Publisher, destination, and source semantics verified

    URL: https://www.cve.org/CVERecord?id=CVE-2026-42159

    CVE Program - Official CVE Program record with source-provided CVE metadata.

  • CVE-2026-42159 NVD vulnerability detail

    Publisher, destination, and source semantics verified

    URL: https://nvd.nist.gov/vuln/detail/CVE-2026-42159

    NIST National Vulnerability Database - Official NIST NVD detail page and source-specific vulnerability assessment.

Supplemental references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.