Executive brief
CTI-Transmute is a tool used to convert and visualize cyber threat intelligence data in MISP and STIX formats. A stored XSS vulnerability in the conversion graph allows attackers to inject malicious JavaScript that executes when other users view converted CTI data, potentially compromising their sessions or stealing sensitive intelligence information.
Technical details
CTI-Transmute contains a stored cross-site scripting (XSS) vulnerability in its conversion graph visualization component. Attacker-controlled values from converted CTI data—including node labels, sublabels, edge labels, properties, and types—are passed to the Pivotick graph rendering library and an open raw JSON viewer without adequate HTML escaping. The Pivotick library renders these values via HTML-parsing operations (template.innerHTML), allowing injected HTML elements with event handlers to execute as code. Additionally, the raw JSON viewer used document.write() with interpolated strings, enabling attackers to break out of the <pre> element and inject executable markup. Multiple patches have addressed these vectors by HTML-escaping label and property values, restricting node types to safe characters, and replacing document.write() with DOM APIs and textContent assignment.
Affected products
- <UNKNOWN> CTI-Transmute
Timeline
- 2026-08-10: disclosed