# CVE-2026-9806: MISP CTI Transmute stored XSS in notification panel

Source: https://junglewise.ai/threats/cve-2026-9806-misp-cti-transmute-stored-xss-in-notification-panel  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-05-28. Updated: 2026-05-28  
License: CC BY 4.0 with a link back

CVE-2026-9806 · Severity: info · CVSS 6.3 · Published 2026-05-28

A security vulnerability was identified in CTI Transmute, a tool used for processing cyber threat intelligence. The flaw exists in the notification system, where malicious data could be used to execute unauthorized scripts in a user's web browser. If exploited, an attacker could hijack a user's session or access sensitive information within the application. This issue was primarily found in a development version of the software.

Vendors: [MISP Project](https://junglewise.ai/threats/vendors/misp-project).

## Quick answers

**Is CVE-2026-9806 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-9806 being exploited in the wild.

**How severe is CVE-2026-9806?** Informational severity, with a CVSS score of 6.3, published 28 May 2026.

**Which products and versions are affected?** MISP Project CTI Transmute prior to commit cf42409 (development branch).

**Is there a fix for CVE-2026-9806?** No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

**How is CVE-2026-9806 attacked?** It is attacked over the network, in a web application.

**Am I affected by CVE-2026-9806?** Check whether you run MISP Project CTI Transmute at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

A stored cross-site scripting (XSS) vulnerability exists in the notification panel of CTI Transmute. The root cause is the use of the 'innerHTML' property to render notification messages containing user-controlled 'convert names' without proper sanitization. An attacker who can influence these names can inject malicious scripts that execute when an authenticated user opens the notification bell dropdown. The vulnerability was identified in a development branch and has been remediated by switching to 'textContent' and DOM-based element construction to ensure input is treated as literal text rather than executable code.

## Affected products

- MISP CTI Transmute prior to commit cf42409 (development branch)

## Timeline

- 2026-05-28: disclosed
- 2026-05-28: advisory

## References

- [https://github.com/MISP/cti-transmute/commit/cf42409badc27b13d9bb644b9175aa7f27e11259](https://github.com/MISP/cti-transmute/commit/cf42409badc27b13d9bb644b9175aa7f27e11259)