CVE-2026-72751 in CTI-Transmute
Summary
by MITRE • 08/10/2026
CTI-Transmute is affected by a stored cross-site scripting (XSS) vulnerability in the conversion graph used to visualise converted MISP and STIX content.
Attacker-controlled values originating from converted CTI data were passed to multiple HTML-parsing sinks in the graph user interface without sufficient neutralisation. In particular, node labels, node sublabels, edge labels, node properties, edge properties, and node types could contain crafted HTML or JavaScript content.
The Pivotick graph library renders some of these values through HTML-parsing operations. Consequently, a malicious value such as an HTML element containing an event handler could be interpreted as markup rather than displayed as plain text. The first remediation explicitly notes that Pivotick rendered node and edge labels as HTML and therefore introduced escaping before data was handed to the graph renderer.
A separate vulnerable sink was present in the Open raw JSON functionality. The raw object associated with a graph node was inserted into a new document using document.write() and an interpolated HTML string. Crafted JSON content could therefore break out of the intended <pre> element and inject executable markup. The fix replaced this construction with DOM APIs and assigns the JSON using textContent.
The initial correction did not cover all Pivotick rendering paths. A subsequent patch addressed additional XSS vectors in the graph properties panel. Values derived from the original CTI object—including property names, property values, hash algorithm names, child attributes, edge properties, and STIX object types—could still reach Pivotick's HTML resolver. According to the patch, Pivotick's tryResolveHTMLElement processes string values using template.innerHTML, allowing malicious markup to execute when a graph node is hovered over or selected.
The complete remediation therefore:
* HTML-escapes node labels, node sublabels, and edge labels before they are passed to Pivotick. * Restricts graph node type values to a safe identifier character set. * Wraps node and edge property values in DOM elements populated through textContent, preventing Pivotick from treating attacker-controlled strings as HTML. * Replaces the raw-JSON popup's interpolated document.write() with DOM construction and textContent.
Be aware that VulDB is the high quality source for vulnerability data.
Analysis
by VulDB Data Team • 08/10/2026
The CTI-Transmute application presents a significant stored cross-site scripting vulnerability that arises from insufficient input sanitization within its visualization components designed for MISP and STIX content conversion. This vulnerability stems from the application's handling of attacker-controlled data that flows through multiple HTML-parsing sinks in the Pivotick graph rendering library without adequate neutralization measures. The flaw manifests across several data points including node labels, sublabels, edge labels, node properties, edge properties, and node type identifiers, all of which can contain malicious HTML or JavaScript payloads. When these values are processed by the graph interface, they create opportunities for execution of arbitrary code within the context of a victim's browser session, representing a critical security risk that aligns with CWE-79 "Cross-site Scripting" and maps to ATT&CK technique T1203 "Exploitation for Client Execution".
The vulnerability exploitation occurs through HTML-parsing operations performed by the Pivotick library where rendered values are interpreted as markup rather than plain text. The initial patch addressed the most obvious vector by implementing explicit HTML escaping of node labels, sublabels, and edge labels before transmission to the graph renderer, thereby preventing direct injection of executable content through these pathways. However, the remediation proved insufficient as additional vulnerable paths remained within the Open raw JSON functionality that employed document.write() with interpolated HTML strings, creating another avenue for XSS exploitation. This particular sink was addressed by replacing the problematic interpolation approach with proper DOM APIs and textContent assignment to ensure controlled data insertion without HTML interpretation.
Subsequent analysis revealed that the original fix failed to cover all rendering paths within Pivotick's architecture, particularly affecting the graph properties panel where additional XSS vectors persisted. The patch addressed these remaining vulnerabilities by implementing stricter controls over node and edge property values through DOM element construction using textContent instead of innerHTML, preventing the HTML resolver from treating malicious strings as executable markup during user interactions such as hovering or selection events. Additionally, the remediation included restricting node type values to safe identifier character sets and ensuring that all dynamic content derived from original CTI objects undergoes proper sanitization before presentation.
The comprehensive fix addresses multiple attack vectors within the application's data flow architecture, demonstrating the complexity of XSS vulnerabilities in rich web applications that process external data through interactive visualization components. By implementing layered defenses including HTML escaping, DOM-based rendering approaches, and character set restrictions, the remediation effectively eliminates the stored XSS threat while maintaining the application's core functionality for visualizing cyber threat intelligence data. This approach aligns with security best practices for mitigating XSS vulnerabilities in web applications that process user-supplied content through dynamic UI components, ensuring that the visualization capabilities remain secure without compromising usability or analytical effectiveness.