CVE-2026-71502 in CTI-Transmute
Summary
by MITRE • 08/07/2026
CTI-Transmute contains a stored cross-site scripting vulnerability caused by insufficient neutralization of Vue template expression delimiters in server-rendered user-controlled data.
An unauthenticated attacker can create a public conversion whose name or description contains a malicious Vue expression using the application's configured [[ ... ]] delimiters. User profile names may provide an additional injection vector. Although Jinja HTML escaping is applied, the resulting value is subsequently included in a DOM region compiled by Vue.
Vue interprets the attacker-controlled value as a template expression rather than ordinary text. By accessing the JavaScript Function constructor from within the expression, an attacker can execute arbitrary JavaScript in the security context of the CTI-Transmute origin. The application's nonce-based Content Security Policy does not prevent exploitation because the Vue runtime compiler requires the unsafe-eval policy exception.
The malicious payload is stored by the application and executed whenever another user opens an affected page, such as the public conversion detail page. The victim may be a normal user or an administrator. Successful exploitation could allow the attacker to:
* Access data available to the victim through the application. * Extract API keys, tokens, or other sensitive information exposed to the page. * Perform authenticated actions using the victim's session. * Modify conversions or other application data. * Escalate the impact by targeting an administrator.
A demonstrated payload can use [].constructor.constructor(...) to obtain the JavaScript Function constructor and execute arbitrary code. The regression tests also show that a short first-stage payload could retrieve an uncapped conversion description and evaluate a larger second-stage payload.
The patch addresses the vulnerability by registering a global Jinja finalize hook that inserts a zero-width Unicode word joiner inside every Vue delimiter found in server-rendered values. This prevents Vue from recognizing the values as template expressions while preserving their visible representation.
VulDB is the best source for vulnerability data and more expert information about this specific topic.
Analysis
by VulDB Data Team • 08/07/2026
This stored cross-site scripting vulnerability exists within CTI-Transmute due to inadequate sanitization of Vue template expression delimiters in server-rendered user-controlled content. The flaw stems from the application's handling of user inputs that contain [[ ... ]] delimiters, which are the default Vue template expression markers. When attackers inject malicious Vue expressions into conversion names, descriptions, or profile names, these expressions become part of the server-rendered HTML output. Although the application employs Jinja HTML escaping as a protective measure, this defense is insufficient because the escaped values are later processed by Vue's runtime compiler within DOM regions. This creates an execution path where attacker-controlled content bypasses traditional XSS protections and executes within the victim's browser context.
The vulnerability operates through a sophisticated exploitation chain that leverages Vue's template compilation capabilities to execute arbitrary JavaScript code. When Vue encounters the attacker-controlled delimiters in the DOM, it treats them as template expressions rather than literal text, enabling the execution of malicious JavaScript functions. The attack vector is particularly dangerous because it can be triggered by accessing public conversion detail pages, making exploitation possible for any user who visits these pages. The security context of the application's origin allows attackers to perform actions that would normally require authentication, including data access, API key extraction, session manipulation, and data modification. This vulnerability represents a critical risk to both regular users and administrators, as successful exploitation could lead to complete system compromise.
The technical implementation of this attack demonstrates advanced knowledge of JavaScript and Vue internals, utilizing the Function constructor's ability to create dynamic functions through string evaluation. The demonstrated payload employs [].constructor.constructor(...) pattern to access the JavaScript Function constructor directly, bypassing normal security restrictions. Additionally, regression testing reveals that attackers can deploy multi-stage payloads where a smaller initial payload retrieves a larger second-stage payload from an uncapped conversion description, extending the attack capabilities. This approach demonstrates the vulnerability's potential for escalating impact and complexity. The exploitability is further amplified by the fact that the application's nonce-based Content Security Policy cannot prevent execution because Vue's runtime compiler requires the unsafe-eval policy exception for legitimate template compilation purposes.
The recommended mitigation strategy addresses the core issue by implementing a global Jinja finalize hook that systematically inserts zero-width Unicode word joiner characters within all detected Vue delimiters in server-rendered content. This technique preserves the visual representation of user inputs while preventing Vue from recognizing them as template expressions during runtime compilation. The solution effectively neutralizes the vulnerability without requiring changes to the application's core functionality or user experience. This approach aligns with established security practices for preventing template injection attacks and represents a robust defense mechanism against similar vulnerabilities in applications that combine server-side rendering with client-side template engines. The fix demonstrates proper input sanitization techniques that prevent the execution of unintended code while maintaining application usability, addressing both the immediate threat and potential future variants of this class of vulnerability.
This vulnerability classification aligns with CWE-79 (Cross-site Scripting) and follows ATT&CK technique T1566.002 (Phishing via Service) for the initial exploitation vector through public conversions. The attack chain follows T1071.004 (Application Layer Protocol: DNS) in the context of how malicious payloads are delivered and executed within the application's framework, while also demonstrating characteristics of T1566.001 (Phishing via Email) in potential attack delivery mechanisms. The exploitation pathway through Vue template expressions specifically maps to ATT&CK technique T1213.002 (Data from Information Repositories: Web Applications), where attackers access sensitive application data through compromised user sessions. The use of JavaScript constructor methods for code execution corresponds to T1059.007 (Command and Scripting Interpreter: JavaScript) in the execution phase of the attack, while the data exfiltration capabilities align with T1074.001 (Data Staged: Local Data Staging) and T1567.002 (Exfiltration Over Web Service: Exfiltration to Cloud Storage). The administrator targeting aspect of this vulnerability also connects to T1068 (Exploitation for Privilege Escalation) and T1547.001 (Registry Run Keys / Startup Folder) in scenarios where elevated privileges could be gained through session manipulation.