CVE-2026-42157: Stored XSS in Flowsint Map Nodes

Successful exploitation of CVE-2026-42157 allows an attacker to inject arbitrary HTML and JavaScript code into Flowsint's map node labels. When a user views the map and selects a malicious node, the injected code will execute in their browser context. This can lead to various attacks, including session hijacking, credential theft, and redirection to malicious websites. The impact is particularly severe if Flowsint is used within an organization with sensitive data or access controls, as an attacker could potentially compromise user accounts and gain unauthorized access to systems.

1. Veröffentlicht2026-05-12

The primary mitigation for CVE-2026-42157 is to upgrade Flowsint to version 1.2.3 or later. Until upgraded, implement strict input validation on all user-supplied data, specifically when creating or modifying map node labels. Sanitize HTML input to remove potentially malicious tags and attributes. Consider using a Content Security Policy (CSP) to restrict the execution of scripts from untrusted sources. There are no specific WAF rules or detection signatures readily available, so focus on patching and input validation. After upgrading, confirm the fix by attempting to create a map node with a malicious HTML payload and verifying that the HTML is properly sanitized.