CVE-2026-81814

Affected versions of Flowintel render calendar event titles using innerHTML. Because those titles are derived from case titles, a user able to create or modify a case title could store HTML or script-capable content that is later interpreted by the browser when another user views the calendar.


The fix changes:


titleEl.innerHTML = arg.event.title


to:


titleEl.textContent = arg.event.title || ''

and similarly stops using innerHTML for the static download icon.

Version impacted =>3.3.0