CVE-2026-42159 is a stored cross-site scripting vulnerability in the open-source OSINT graph exploration tool Flowsint by reconurge. In versions before 1.2.3, nodes within sketches can contain descriptions with arbitrary HTML. When a user selects such a node, the malicious HTML is rendered without proper input neutralization, enabling stored XSS attacks. This vulnerability has a CVSS 4.0 base score of 5.3 (medium severity) and does not require privileges or authentication to exploit, but requires user interaction. The vulnerability is fixed in Flowsint version 1.2.3.

Successful exploitation allows remote attackers to execute arbitrary HTML/JavaScript in the context of the victim's browser when they select a maliciously crafted node. This can lead to session hijacking, information disclosure, or other client-side impacts typical of stored XSS vulnerabilities. There is no indication of privilege escalation or direct system compromise from the provided data.

Upgrade Flowsint to version 1.2.3 or later, where this vulnerability is fixed. Since this is an open-source tool and not a cloud service, users must apply the update themselves. Patch status is not explicitly stated but the description confirms the issue is fixed in 1.2.3. No other mitigation or temporary workaround is provided.