CVE-2026-81814

See a problem?
Please try reporting it to the source first.
Source
https://cve.org/CVERecord?id=CVE-2026-81814
Import Source
https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-81814.json
JSON Data
https://api.osv.dev/v1/vulns/CVE-2026-81814
Published
2026-08-27T12:48:39.314Z
Modified
2026-08-30T03:30:40.009303223Z
Severity
  • 5.1 (Medium) CVSS_V4 - CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:P/VC:L/VI:L/VA:N/SC:L/SI:L/SA:N CVSS Calculator
Summary
Flowintel Stored XSS in Calendar via Malicious Case Title
Details

Affected versions of Flowintel render calendar event titles using innerHTML. Because those titles are derived from case titles, a user able to create or modify a case title could store HTML or script-capable content that is later interpreted by the browser when another user views the calendar.

The fix changes:

titleEl.innerHTML = arg.event.title

to:

titleEl.textContent = arg.event.title || ''

and similarly stops using innerHTML for the static download icon.

Version impacted =>3.3.0

Database specific 
{
    "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/81xxx/CVE-2026-81814.json",
    "cna_assigner": "CIRCL",
    "cwe_ids": [
        "CWE-79"
    ]
}
References

Affected packages

Git / github.com/flowintel/flowintel

Affected ranges

Type
GIT
Repo
https://github.com/flowintel/flowintel
Events
Introduced
0 Unknown introduced commit / All previous commits are affected
Fixed
f224438eb495e6b0d4e465eb7f40ab771bbfdb76
Database specific
Show details 
{
    "source": [
        "AFFECTED_FIELD",
        "REFERENCES"
    ],
    "extracted_events": [
        {
            "introduced": "0"
        },
        {
            "last_affected": "3.3.0"
        }
    ]
}

Affected versions

0.*
0.0.1
0.1.0
0.2.0
0.2.1
0.3.0
0.4.0
0.5.0
0.5.1
0.6.0
0.7.0
0.8.0
1.*
1.0.0
1.1.0
1.2.0
1.3.0
1.3.1
1.4.0
1.4.1
1.5.0
1.6.0
1.6.1
1.6.2
2.*
2.0.0
2.1.0
2.1.1
2.2.1
2.3.0
3.*
3.0.0
3.1.0
3.2.0
3.3.0

Database specific

source 
"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-81814.json"