FlowIntel suffers from a stored XSS vulnerability (CWE-79) where persisted values in various fields are rendered inside DOM elements compiled by Vue.js. Although HTML escaping prevents direct HTML injection, it does not block Vue interpolation expressions using [[ ... ]] delimiters. Authenticated attackers who can modify affected fields may inject malicious Vue expressions that execute arbitrary JavaScript in the victim's browser under the FlowIntel origin. This can lead to information disclosure, unauthorized actions, or data modification within the victim's privileges. The vendor's fix involves a vue_escape filter that escapes HTML-sensitive characters and breaks Vue interpolation delimiters before rendering these values.

Successful exploitation allows arbitrary JavaScript execution in the context of the FlowIntel application in the victim's browser. This can expose sensitive information accessible to the victim, perform actions using the victim’s authenticated session, or modify application data within the victim’s privilege scope. The vulnerability requires authentication and user interaction (viewing affected pages).

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. The vendor has introduced a vue_escape filter to mitigate the vulnerability by escaping HTML-sensitive characters and breaking Vue interpolation delimiters before rendering affected fields. Until official patches or updates are confirmed, restrict modification of affected fields to trusted users and monitor for suspicious activity related to these fields.