CVE-2026-81814
Flowintel Stored XSS in Calendar via Malicious Case Title
CVSS Score
0.0
EPSS Score
0.0%
EPSS Percentile
0th
Affected versions of Flowintel render calendar event titles using innerHTML. Because those titles are derived from case titles, a user able to create or modify a case title could store HTML or script-capable content that is later interpreted by the browser when another user views the calendar. The fix changes: titleEl.innerHTML = arg.event.title to: titleEl.textContent = arg.event.title || '' and similarly stops using innerHTML for the static download icon. Version impacted =>3.3.0
| CWE | CWE-79 |
| Vendor | flowintel |
| Product | flowintel |
| Published | Aug 27, 2026 |
Stay Ahead of the Next One
Get instant alerts for flowintel flowintel
Be the first to know when new unknown vulnerabilities affecting flowintel flowintel are published — delivered to Slack, Telegram or Discord.
Get Free Alerts →
Free · No credit card · 60 sec setup
Affected Versions
flowintel / flowintel
0 ≤ 3.3.0
References
Credits
Jeroen Pinoy David Cruciani