CVE-2026-32311

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-32311", "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "state": "PUBLISHED", "assignerShortName": "GitHub_M", "dateReserved": "2026-03-11T21:16:21.660Z", "datePublished": "2026-04-20T19:56:32.521Z", "dateUpdated": "2026-04-21T13:44:08.776Z"}, "containers": {"cna": {"title": "Command Injection and Docker container escape allows root on host machine", "problemTypes": [{"descriptions": [{"cweId": "CWE-78", "lang": "en", "description": "CWE-78: Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')", "type": "CWE"}]}], "metrics": [{"cvssV4_0": {"attackVector": "NETWORK", "attackComplexity": "LOW", "attackRequirements": "NONE", "privilegesRequired": "NONE", "userInteraction": "NONE", "vulnConfidentialityImpact": "HIGH", "vulnIntegrityImpact": "HIGH", "vulnAvailabilityImpact": "HIGH", "subConfidentialityImpact": "HIGH", "subIntegrityImpact": "HIGH", "subAvailabilityImpact": "HIGH", "baseScore": 9.3, "baseSeverity": "CRITICAL", "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H/E:P", "version": "4.0"}}], "references": [{"name": "https://github.com/reconurge/flowsint/security/advisories/GHSA-9g44-8xv2-f2m9", "tags": ["x_refsource_CONFIRM"], "url": "https://github.com/reconurge/flowsint/security/advisories/GHSA-9g44-8xv2-f2m9"}, {"name": "https://github.com/reconurge/flowsint/commit/b52cbbb904c8013b74308d58af88bc7dbb1b055c", "tags": ["x_refsource_MISC"], "url": "https://github.com/reconurge/flowsint/commit/b52cbbb904c8013b74308d58af88bc7dbb1b055c"}], "affected": [{"vendor": "reconurge", "product": "flowsint", "versions": [{"version": "< b52cbbb904c8013b74308d58af88bc7dbb1b055c", "status": "affected"}]}], "providerMetadata": {"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "shortName": "GitHub_M", "dateUpdated": "2026-04-20T19:56:32.521Z"}, "descriptions": [{"lang": "en", "value": "Flowsint is an open-source OSINT graph exploration tool designed for cybersecurity investigation, transparency, and verification. Flowsint allows a user to create investigations, which are used to manage sketches and analyses. Sketches have controllable graphs, which are comprised of nodes and relationships. The sketches contain information on an OSINT target (usernames, websites, etc) within these nodes and relationships. The nodes can have automated processes execute on them called 'transformers'. A remote attacker can create a sketch, then trigger the 'org_to_asn' transform on an organization node to execute arbitrary OS commands as root on the host machine via shell metacharacters and a docker container escape. Commit b52cbbb904c8013b74308d58af88bc7dbb1b055c appears to remove the code that causes this issue."}], "source": {"advisory": "GHSA-9g44-8xv2-f2m9", "discovery": "UNKNOWN"}}, "adp": [{"references": [{"url": "https://github.com/reconurge/flowsint/security/advisories/GHSA-9g44-8xv2-f2m9", "tags": ["exploit"]}], "metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2026-04-21T13:44:05.342265Z", "id": "CVE-2026-32311", "options": [{"Exploitation": "poc"}, {"Automatable": "yes"}, {"Technical Impact": "total"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-04-21T13:44:08.776Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"cna": {"title": "Command Injection and Docker container escape allows root on host machine", "source": {"advisory": "GHSA-9g44-8xv2-f2m9", "discovery": "UNKNOWN"}, "metrics": [{"cvssV4_0": {"version": "4.0", "baseScore": 9.3, "attackVector": "NETWORK", "baseSeverity": "CRITICAL", "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H/E:P", "userInteraction": "NONE", "attackComplexity": "LOW", "attackRequirements": "NONE", "privilegesRequired": "NONE", "subIntegrityImpact": "HIGH", "vulnIntegrityImpact": "HIGH", "subAvailabilityImpact": "HIGH", "vulnAvailabilityImpact": "HIGH", "subConfidentialityImpact": "HIGH", "vulnConfidentialityImpact": "HIGH"}}], "affected": [{"vendor": "reconurge", "product": "flowsint", "versions": [{"status": "affected", "version": "< b52cbbb904c8013b74308d58af88bc7dbb1b055c"}]}], "references": [{"url": "https://github.com/reconurge/flowsint/security/advisories/GHSA-9g44-8xv2-f2m9", "name": "https://github.com/reconurge/flowsint/security/advisories/GHSA-9g44-8xv2-f2m9", "tags": ["x_refsource_CONFIRM"]}, {"url": "https://github.com/reconurge/flowsint/commit/b52cbbb904c8013b74308d58af88bc7dbb1b055c", "name": "https://github.com/reconurge/flowsint/commit/b52cbbb904c8013b74308d58af88bc7dbb1b055c", "tags": ["x_refsource_MISC"]}], "descriptions": [{"lang": "en", "value": "Flowsint is an open-source OSINT graph exploration tool designed for cybersecurity investigation, transparency, and verification. Flowsint allows a user to create investigations, which are used to manage sketches and analyses. Sketches have controllable graphs, which are comprised of nodes and relationships. The sketches contain information on an OSINT target (usernames, websites, etc) within these nodes and relationships. The nodes can have automated processes execute on them called 'transformers'. A remote attacker can create a sketch, then trigger the 'org_to_asn' transform on an organization node to execute arbitrary OS commands as root on the host machine via shell metacharacters and a docker container escape. Commit b52cbbb904c8013b74308d58af88bc7dbb1b055c appears to remove the code that causes this issue."}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-78", "description": "CWE-78: Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')"}]}], "providerMetadata": {"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "shortName": "GitHub_M", "dateUpdated": "2026-04-20T19:56:32.521Z"}}, "adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2026-32311", "role": "CISA Coordinator", "options": [{"Exploitation": "poc"}, {"Automatable": "yes"}, {"Technical Impact": "total"}], "version": "2.0.3", "timestamp": "2026-04-21T13:44:05.342265Z"}}}], "references": [{"url": "https://github.com/reconurge/flowsint/security/advisories/GHSA-9g44-8xv2-f2m9", "tags": ["exploit"]}], "providerMetadata": {"shortName": "CISA-ADP", "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "dateUpdated": "2026-04-21T13:43:58.019Z"}}]}, "cveMetadata": {"cveId": "CVE-2026-32311", "state": "PUBLISHED", "dateUpdated": "2026-04-20T19:56:32.521Z", "dateReserved": "2026-03-11T21:16:21.660Z", "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "datePublished": "2026-04-20T19:56:32.521Z", "assignerShortName": "GitHub_M"}, "dataVersion": "5.2"}

{"affected": [{"affectedData": [{"product": "flowsint", "vendor": "reconurge", "versions": [{"status": "affected", "version": "< b52cbbb904c8013b74308d58af88bc7dbb1b055c"}]}], "source": "security-advisories@github.com"}], "configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:a:flowsint:flowsint:-:*:*:*:*:*:*:*", "matchCriteriaId": "DA7E817D-B226-456A-9BEE-823E65410AA8", "vulnerable": true}], "negate": false, "operator": "OR"}]}], "cveTags": [], "descriptions": [{"lang": "en", "value": "Flowsint is an open-source OSINT graph exploration tool designed for cybersecurity investigation, transparency, and verification. Flowsint allows a user to create investigations, which are used to manage sketches and analyses. Sketches have controllable graphs, which are comprised of nodes and relationships. The sketches contain information on an OSINT target (usernames, websites, etc) within these nodes and relationships. The nodes can have automated processes execute on them called 'transformers'. A remote attacker can create a sketch, then trigger the 'org_to_asn' transform on an organization node to execute arbitrary OS commands as root on the host machine via shell metacharacters and a docker container escape. Commit b52cbbb904c8013b74308d58af88bc7dbb1b055c appears to remove the code that causes this issue."}, {"lang": "es", "value": "Flowsint es una herramienta de exploraci\u00f3n de grafos OSINT de c\u00f3digo abierto dise\u00f1ada para la investigaci\u00f3n de ciberseguridad, la transparencia y la verificaci\u00f3n. Flowsint permite a un usuario crear investigaciones, que se utilizan para gestionar bocetos y an\u00e1lisis. Los bocetos tienen grafos controlables, que est\u00e1n compuestos por nodos y relaciones. Los bocetos contienen informaci\u00f3n sobre un objetivo OSINT (nombres de usuario, sitios web, etc.) dentro de estos nodos y relaciones. Los nodos pueden tener procesos automatizados ejecut\u00e1ndose en ellos llamados \u2019transformers\u2019. Un atacante remoto puede crear un boceto, luego activar la transformaci\u00f3n \u2019org_to_asn\u2019 en un nodo de organizaci\u00f3n para ejecutar comandos arbitrarios del sistema operativo como root en la m\u00e1quina anfitriona a trav\u00e9s de metacaracteres de shell y un escape de contenedor docker. El commit b52cbbb904c8013b74308d58af88bc7dbb1b055c parece eliminar el c\u00f3digo que causa este problema."}], "id": "CVE-2026-32311", "lastModified": "2026-10-26T22:10:00.163", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 9.8, "baseSeverity": "CRITICAL", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H", "version": "3.1"}, "exploitabilityScore": 3.9, "impactScore": 5.9, "source": "nvd@nist.gov", "type": "Primary"}], "cvssMetricV40": [{"cvssData": {"Automatable": "NOT_DEFINED", "Recovery": "NOT_DEFINED", "Safety": "NOT_DEFINED", "attackComplexity": "LOW", "attackRequirements": "NONE", "attackVector": "NETWORK", "availabilityRequirement": "NOT_DEFINED", "baseScore": 9.3, "baseSeverity": "CRITICAL", "confidentialityRequirement": "NOT_DEFINED", "exploitMaturity": "PROOF_OF_CONCEPT", "integrityRequirement": "NOT_DEFINED", "modifiedAttackComplexity": "NOT_DEFINED", "modifiedAttackRequirements": "NOT_DEFINED", "modifiedAttackVector": "NOT_DEFINED", "modifiedPrivilegesRequired": "NOT_DEFINED", "modifiedSubAvailabilityImpact": "NOT_DEFINED", "modifiedSubConfidentialityImpact": "NOT_DEFINED", "modifiedSubIntegrityImpact": "NOT_DEFINED", "modifiedUserInteraction": "NOT_DEFINED", "modifiedVulnAvailabilityImpact": "NOT_DEFINED", "modifiedVulnConfidentialityImpact": "NOT_DEFINED", "modifiedVulnIntegrityImpact": "NOT_DEFINED", "privilegesRequired": "NONE", "providerUrgency": "NOT_DEFINED", "subAvailabilityImpact": "HIGH", "subConfidentialityImpact": "HIGH", "subIntegrityImpact": "HIGH", "userInteraction": "NONE", "valueDensity": "NOT_DEFINED", "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X", "version": "4.0", "vulnAvailabilityImpact": "HIGH", "vulnConfidentialityImpact": "HIGH", "vulnIntegrityImpact": "HIGH", "vulnerabilityResponseEffort": "NOT_DEFINED"}, "source": "security-advisories@github.com", "type": "Secondary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-32311", "options": [{"exploitation": "poc"}, {"automatable": "yes"}, {"technicalImpact": "total"}], "role": "CISA Coordinator", "timestamp": "2026-04-21T13:44:05.342265Z", "version": "2.0.3"}}]}, "published": "2026-04-20T20:16:48.653", "references": [{"source": "security-advisories@github.com", "tags": ["Patch"], "url": "https://github.com/reconurge/flowsint/commit/b52cbbb904c8013b74308d58af88bc7dbb1b055c"}, {"source": "security-advisories@github.com", "tags": ["Exploit", "Vendor Advisory"], "url": "https://github.com/reconurge/flowsint/security/advisories/GHSA-9g44-8xv2-f2m9"}, {"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "tags": ["Exploit", "Vendor Advisory"], "url": "https://github.com/reconurge/flowsint/security/advisories/GHSA-9g44-8xv2-f2m9"}], "sourceIdentifier": "security-advisories@github.com", "vulnStatus": "Analyzed", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-78"}], "source": "security-advisories@github.com", "type": "Secondary"}]}

{}

{"affected": [{"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[0,b52cbbb904c8013b74308d58af88bc7dbb1b055c)"}}], "enrichment": {"confidence": 100.0, "confidence_source": "cna", "scores": [{"score": 100.0, "source": "cna"}]}, "original": {"product": "flowsint", "source": "cna", "vendor": "reconurge"}, "product": "flowsint", "vendor": "reconurge"}], "analysis": {"en": {"generated_at": "2026-04-21T15:44:21.779108+00:00", "value": {"mitigation_remediation": ["Apply the patch that removes the vulnerable code (commit b52cbbb) or upgrade to a Flowsint version that incorporates this fix.", "Restrict the \"org_to_asn\" transformer to trusted users only or disable it for untrusted sketches to prevent arbitrary input reaching the shell.", "Run Flowsint in a non\u2011privileged environment, ensuring Docker containers started by the tool do not run in privileged mode and have read\u2011only root filesystems to limit container escape chances."], "summary": {"action": "Immediate Patch", "impact": "Remote Code Execution with Host Escalation"}, "threat_synthesis": {"affected_systems": "The vulnerability exists in the open\u2011source Flowsint tool developed by reconurge. All releases prior to the commit that removed the vulnerable code (b52cbbb) are affected. No specific version numbers are listed in the advisory, so any installation that has not applied the fix is potentially exploitable.", "description_and_impact": "A remote attacker who can create a sketch in Flowsint can trigger the \"org_to_asn\" transformer on an organization node. The transformer incorrectly includes user-controlled data in a shell command, allowing the attacker to insert shell metacharacters that result in arbitrary OS command execution as the host process\u2019s root user. This is a classic command injection flaw (CWE-78) that also provides a pathway to escape a restricted Docker container and compromise the entire host system.", "risk_and_exploitability": "The flaw receives a CVSS score of 9.3, indicating a high severity attack that can be performed remotely. The likely attack vector, inferred from the fact that the transformer is triggered through the web interface or API, is not explicitly stated in the advisory but can be reasonably assumed. No EPSS score is available, but the absence of a KEV listing does not diminish the risk; an attacker who can reach the Flowsint service can run commands with root privileges and potentially escape the Docker container. The attack would require that the vulnerable transformer be executed, making it a privilege escalation rather than a pure denial-of-service scenario."}}}}, "created": "2026-04-21T15:45:07.487569+00:00", "updated": "2026-04-22T11:47:18.882296+00:00", "vendors": ["reconurge", "reconurge$PRODUCT$flowsint"]}