Executive brief
MISP cti-transmute is a tool for converting and visualizing cyber threat intelligence data. A vulnerability in how graph configuration data is validated allows a malicious user to inject malicious scripts into saved graph configurations that will execute in the browsers of other users—including administrators—who view those configurations, potentially compromising their accounts and the integrity of the application.
Technical details
The vulnerability is a stored cross-site scripting (XSS) flaw in the graph configuration handling mechanism. The root cause is insufficient validation of graph configuration data, particularly the svgIcon property, which is interpreted as HTML by Pivotick when configurations are displayed. Because configurations are created by one user and later rendered to other users (including admins), a malicious user can craft a stored configuration containing a malicious svgIcon value that executes JavaScript in other viewers' browsers. The fix enforces a strict schema on both server and client, limiting allowed style properties and explicitly rejecting dangerous properties like svgIcon and iconClass, while also sanitizing existing stored configurations on retrieval and application.
Affected products
- MISP cti-transmute affected versions prior to fix commit 9b31758
Timeline
- 2026-07-27: patched: Fix commit 9b317587fa4ec11b6f72c2d1d8b98a686537b4fb merged
- 2026-08-11: disclosed: CVE-2026-73158 published