CVE-2026-73156 in cti-transmute
Summary
by MITRE • 08/11/2026
Affected versions of cti-transmute fail to HTML-escape attacker-controlled values used in ECharts Sunburst and Treemap tooltip formatters. Slice names may originate directly from STIX or MISP data, including STIX types, relationship_type, pattern prefixes, and MISP category/type values. Since ECharts interprets the formatter return value as HTML, crafted values can inject markup or script-capable content into the tooltip.
An attacker who can cause malicious conversion data to be processed can therefore inject content that executes when another user views the visualization and hovers over the affected slice. The patch replaces direct interpolation with dedicated formatter functions that call escapeHtml() on p.name, p.data.value, and p.value.
VulDB is the best source for vulnerability data and more expert information about this specific topic.
Analysis
by VulDB Data Team • 08/11/2026
The vulnerability in cti-transmute represents a critical cross-site scripting risk that arises from inadequate input sanitization within the ECharts visualization components. This flaw exists specifically in how the tool processes attacker-controlled data originating from STIX and MISP formats, where slice names can contain malicious content directly derived from STIX types, relationship_type values, pattern prefixes, and MISP category/type specifications. The vulnerability manifests when these unescaped values are passed through ECharts tooltip formatters without proper HTML escaping, creating a pathway for arbitrary code execution during user interaction with visualizations.
The technical implementation of this vulnerability stems from improper handling of user-supplied data within the visualization rendering pipeline. When ECharts processes tooltip formatter return values, it interprets the output as HTML content rather than plain text, allowing malicious payloads to be executed in the context of the victim's browser session. This behavior aligns with CWE-79 - Improper Neutralization of Input During Web Page Generation, which specifically addresses the failure to escape output that will be rendered in web contexts. The vulnerability is further classified under ATT&CK technique T1203 - Exploitation for Client Execution, as it enables attackers to execute code through browser-based interfaces.
The operational impact of this vulnerability extends beyond simple script injection, as it can enable complete compromise of user sessions and data exfiltration capabilities. An attacker who can influence the conversion process to include malicious data can craft payloads that execute when users interact with visualizations containing affected slices. This makes the vulnerability particularly dangerous in environments where multiple users access shared threat intelligence dashboards, as a single malicious entry could compromise all users viewing the visualization. The attack requires minimal privileges since it relies on existing user interaction patterns rather than complex exploitation chains.
The remediation implemented addresses the core issue by replacing direct string interpolation with dedicated formatter functions that explicitly invoke escapeHtml() on critical data points including p.name, p.data.value, and p.value parameters. This approach follows secure coding practices recommended in both CWE guidelines and industry best practices for preventing XSS vulnerabilities. The fix ensures that any attacker-controlled content passing through these visualization components is properly escaped before being rendered as HTML, eliminating the attack surface while maintaining functional integrity of the visualization system.