Executive brief
A security vulnerability was identified in CTI Transmute, a tool used for processing cyber threat intelligence. The flaw exists in the notification system, where malicious data could be used to execute unauthorized scripts in a user's web browser. If exploited, an attacker could hijack a user's session or access sensitive information within the application. This issue was primarily found in a development version of the software.
Technical details
A stored cross-site scripting (XSS) vulnerability exists in the notification panel of CTI Transmute. The root cause is the use of the 'innerHTML' property to render notification messages containing user-controlled 'convert names' without proper sanitization. An attacker who can influence these names can inject malicious scripts that execute when an authenticated user opens the notification bell dropdown. The vulnerability was identified in a development branch and has been remediated by switching to 'textContent' and DOM-based element construction to ensure input is treated as literal text rather than executable code.
Affected products
- MISP CTI Transmute prior to commit cf42409 (development branch)
Timeline
- 2026-05-28: disclosed
- 2026-05-28: advisory