CVE-2026-32311

Flowsint is an open-source OSINT graph exploration tool designed for cybersecurity investigation, transparency, and verification. Flowsint allows a user to create investigations, which are used to manage sketches and analyses. Sketches have controllable graphs, which are comprised of nodes and relationships. The sketches contain information on an OSINT target (usernames, websites, etc) within these nodes and relationships. The nodes can have automated processes execute on them called 'transformers'. A remote attacker can create a sketch, then trigger the 'org_to_asn' transform on an organization node to execute arbitrary OS commands as root on the host machine via shell metacharacters and a docker container escape. Commit b52cbbb904c8013b74308d58af88bc7dbb1b055c appears to remove the code that causes this issue.

• CWE-78

• https://github.com/reconurge/flowsint/commit/b52cbbb904c8013b74308d58af88bc7dbb1b055cPatch
• https://github.com/reconurge/flowsint/security/advisories/GHSA-9g44-8xv2-f2m9Exploit, Vendor Advisory
• https://github.com/reconurge/flowsint/security/advisories/GHSA-9g44-8xv2-f2m9Exploit, Vendor Advisory

Published

Apr 20, 2026

Last Modified

Jun 17, 2026

Status

Analyzed

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2026-32305Traefik is an HTTP reverse proxy and load balancer. Versions…5.3
• CVE-2026-32306OneUptime is a solution for monitoring and managing online s…9.9
• CVE-2026-32308OneUptime is a solution for monitoring and managing online s…7.6
• CVE-2026-32309Cryptomator encrypts data being stored on cloud infrastructu…7.5
• CVE-2026-3231The Checkout Field Editor (Checkout Manager) for WooCommerce…7.2
• CVE-2026-32310Cryptomator encrypts data being stored on cloud infrastructu…5.3
• CVE-2026-32312GLPI is a free asset and IT management software package. In …4.3
• CVE-2026-32313xmlseclibs is a library written in PHP for working with XML …8.2
• CVE-2026-32314Yamux is a stream multiplexer over reliable, ordered connect…7.5
• CVE-2026-32315motionEye (mEye) is an online interface for motion software,…5.5
• CVE-2026-32316jq is a command-line JSON processor. An integer overflow vul…7.5
• CVE-2026-32317Cryptomator for Android offers multi-platform transparent cl…5.9