CVE-2026-32311

CVE-2026-32311 is a remote code execution vulnerability in Flowsint, an open-source OSINT graph exploration tool used for cybersecurity investigations. The vulnerability allows attackers to execute arbitrary operating system commands with root privileges by creating a sketch and triggering the 'org_to_asn' transformer on an organization node, exploiting shell metacharacters and achieving docker container escape. The attack requires network access but low complexity, as an attacker can remotely create a sketch and invoke the vulnerable transformer function. The impact is severe, granting unauthenticated attackers complete system compromise with root-level command execution on the host machine. A fix has been identified in commit b52cbbb904c8013b74308d58af88bc7dbb1b055c. The vulnerability is marked as "Active" on the Hot List, indicating active exploitation attempts or community attention. However, no official CVSS score, exploit code availability, or CISA KEV listing is currently documented. The FAUCET Risk Score of 53.0 and EPSS of 0.0021 suggest moderate concern relative to other vulnerabilities, warranting prompt patching for organizations running Flowsint instances.