# CVE-2026-35212: OpenCTI XSS in email-message observable body rendering

Source: https://junglewise.ai/threats/cve-2026-35212-opencti-xss-in-email-message-observable-body-rendering  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-06-02. Updated: 2026-06-02  
License: CC BY 4.0 with a link back

CVE-2026-35212 · Severity: low · CVSS 3.1 · Published 2026-06-02

OpenCTI, a platform used for managing cyber threat intelligence, contains a security flaw in how it displays email-related data. An attacker could send a specially crafted email message or threat intelligence file that, when viewed by a user, executes malicious code in their browser. This could allow an attacker to perform actions on behalf of the user or steal their login session, potentially compromising the entire threat intelligence database.

Technologies: [pycti (PyPI)](https://junglewise.ai/threats/technologies/pycti). Vendors: [PyPI](https://junglewise.ai/threats/vendors/pypi).

## Quick answers

**Is CVE-2026-35212 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-35212 being exploited in the wild.

**How severe is CVE-2026-35212?** Low severity, with a CVSS score of 3.1, published 2 June 2026.

**Which products and versions are affected?** pycti (PyPI) ECOSYSTEM:introduced=0,fixed=7.260227.0.

**Is there a fix for CVE-2026-35212?** Yes. pycti (PyPI): upgrade to 7.260227.0 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-35212 attacked?** It is attacked over the network, in a network appliance.

**Am I affected by CVE-2026-35212?** Check whether you run pycti (PyPI) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## How to fix

- pycti (PyPI): upgrade to 7.260227.0 or later

  ```sh
  pip install "pycti>=7.260227.0"
  ```


## Technical details

A stored Cross-Site Scripting (XSS) vulnerability exists in OpenCTI versions prior to 7.260227.0. The vulnerability is located in the rendering component for 'email-message' observable body data, where input is not properly sanitized before being displayed in the web interface. An attacker can exploit this by injecting malicious scripts via STIX files or other data ingesters. Successful exploitation requires a user to view the malicious observable, which could then lead to Cross-Site Request Forgery (CSRF) and large-scale session hijacking. The issue is addressed in version 7.260227.0.

## Affected products

- OpenCTI-Platform OpenCTI < 7.260227.0

## Identifiers

- CVE-2026-35212
- PYSEC-2026-203

## Timeline

- 2026-06-01: advisory: GitHub Security Advisory published
- 2026-06-02: disclosed: CVE-2026-35212 published to NVD

## References

- [https://github.com/OpenCTI-Platform/opencti/security/advisories/GHSA-rg6r-x26x-63vq](https://github.com/OpenCTI-Platform/opencti/security/advisories/GHSA-rg6r-x26x-63vq)

## Related threats

- [Filigran OpenCTI Code Injection in GraphQL API](https://junglewise.ai/threats/cve-2026-35211-filigran-opencti-code-injection-in-graphql-api)
- [Filigran OpenCTI authorization bypass via synchronized-upsert header](https://junglewise.ai/threats/cve-2026-35210-filigran-opencti-authorization-bypass-via-synchronized-upsert)
- [OpenCTI SSRF in Data Ingestion Feature](https://junglewise.ai/threats/cve-2026-21887-opencti-ssrf-in-data-ingestion-feature)
- [OpenCTI GraphQL introspection restriction bypass](https://junglewise.ai/threats/cve-2024-37155-opencti-graphql-introspection-restriction-bypass)
- [OpenCTI privilege escalation in userEdit relationAdd](https://junglewise.ai/threats/cve-2026-44730-opencti-privilege-escalation-in-useredit-relationadd)