Executive brief
CTI-Transmute is a data conversion tool that allows users to create and share public conversions. An attacker can inject malicious code into conversion names or descriptions that executes in the browser when other users (including administrators) view those conversions. This could allow the attacker to steal API keys, session tokens, modify data, or escalate privileges by targeting an admin account.
Technical details
The vulnerability is a stored cross-site scripting (XSS) flaw caused by insufficient sanitization of Vue template expression delimiters ([[ ... ]]) in server-rendered, user-controlled data. Although the application applies Jinja HTML escaping, the escaped value is subsequently processed by Vue's runtime compiler, which interprets attacker-controlled delimiters as template expressions. An unauthenticated attacker can bypass this by using [].constructor.constructor(...) to access the JavaScript Function constructor and execute arbitrary code. The nonce-based Content Security Policy does not prevent exploitation because Vue's runtime compiler requires unsafe-eval. The patch registers a global Jinja finalize hook that inserts zero-width Unicode word joiners inside Vue delimiters, preventing Vue from recognizing them as template expressions while maintaining visible appearance.
Affected products
- CTI-Transmute
Timeline
- 2026-08-08: disclosed