CVE-2026-81820
2026-08-27
17h21 +00:00
17h21 +00:00
特定のCVEの通知
特定のCVEの変更情報をいち早くお届けします。
CVE の説明
Affected versions of Flowintel construct timeline HTML using attacker-controllable MISP object fields such as:
*
object UUID;
*
object name;
*
attribute value;
*
attribute type;
*
comment;
*
first/last seen values;
*
IDS flag.
Those values were concatenated directly into HTML strings before rendering. The upstream commit explicitly states that DOMPurify removed XSS vectors but still allowed other HTML elements, such as forms, through.
The fix replaces direct string interpolation with DOM construction via document.createElement() and assigns all attacker-controlled values using textContent. The headline is similarly converted to escaped HTML through a temporary element.
Version impacted =>3.3.0
CVE の情報
関連する弱点
| 弱点名 | 出典 | |
|---|---|---|
| Improper Neutralization of Input During Web Page Generation The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users. |
