CVE-2026-42156CWE-943

Flowsint: Cypher query injection in node type on node creation

High · published May 12, 2026

CVSS v4.0
7.1
EPSS
0%
Percentile
40.6
In the wild
Unconfirmed
What it is

Flowsint is an open-source OSINT graph exploration tool designed for cybersecurity investigation, transparency, and verification. Prior to 1.2.3, a remote attacker can create a node with a malicious type that can escape an existing Cypher query and an adversary can execute an arbitrary Cypher query. This vulnerability is fixed in 1.2.3.

The record
Technical detail
CVSS v4.0
7.1 · HIGH
Vector
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N
EPSS
0.00483 · 40.6th percentile
Weakness
CWE-943 · Improper Neutralization of Special Elements in Data Query Logic
Published
2026-05-12T23:00Z
EPSS history
Timeline
  • 12 MAY 23:00Z
    Flowsint: Cypher query injection in node type on node creation
    cvelistv5