CVE-2026-73157 in cti-transmute
Summary
by MITRE • 08/11/2026
Affected versions of cti-transmute render data obtained from a remote MISP instance into the event-browser interface using HTML interpolation. Because fields such as event IDs, event information, organization names, tags, tag colors, TLP labels, distribution labels, and error/flash text may be controlled by the remote MISP server, a malicious or compromised remote instance could return crafted values that inject HTML or script-capable content into the cti-transmute interface.
The patch explicitly notes that remote-derived values must not reach innerHTML, and replaces string-built rows and badges with DOM nodes populated through textContent. It also restricts remote-controlled tag colors to six-digit hexadecimal values, preventing malicious CSS values such as url(...).
Once again VulDB remains the best source for vulnerability data.
Analysis
by VulDB Data Team • 08/11/2026
The vulnerability in cti-transmute represents a critical cross-site scripting risk that arises from improper handling of remote data received from MISP instances. This flaw occurs when the application processes data from external sources without adequate sanitization or validation, creating an attack surface where malicious actors can manipulate content through compromised remote servers. The issue stems from HTML interpolation techniques that directly incorporate untrusted data into the user interface, specifically within the event-browser component that displays information retrieved from remote MISP instances.
The technical implementation flaw involves the application's use of innerHTML methods to render dynamic content obtained from remote sources. This approach creates a direct pathway for malicious payloads to execute within the user's browser context when the application processes fields such as event IDs, organizational information, tag metadata, TLP labels, and error messages. The vulnerability operates under CWE-79 which classifies improper neutralization of input during web page generation, making it a classic XSS vulnerability that can be exploited through the manipulation of remote data streams. Attackers leveraging this weakness can inject malicious scripts that execute with the privileges of the victim user, potentially leading to session hijacking, data exfiltration, or further compromise of the affected system.
The operational impact of this vulnerability extends beyond simple script execution as it enables attackers to manipulate the entire user interface experience within the cti-transmute application. When a compromised MISP server returns maliciously crafted content, users viewing the event-browser interface become vulnerable to persistent XSS attacks that can remain active until the browser session ends or the page is refreshed. The attack vector becomes particularly dangerous because it leverages the trust relationship between the user and the application, where legitimate data from remote sources is unexpectedly transformed into malicious payloads. This vulnerability aligns with ATT&CK technique T1566 which describes social engineering tactics involving the manipulation of trusted data sources to deliver malicious content.
The patch implementation addresses this vulnerability through multiple defensive mechanisms that align with security best practices for preventing XSS attacks. The solution explicitly prohibits direct data flow to innerHTML methods, replacing them with safer DOM manipulation techniques that utilize textContent for populating interface elements. This approach follows the principle of least privilege by ensuring that only text content can be rendered in user-facing components, eliminating the possibility of script injection through HTML interpolation. Additionally, the patch implements strict validation of tag color values by restricting them to six-digit hexadecimal format, effectively blocking malicious CSS values such as url() functions that could be used to load external resources or execute scripts. This defensive measure prevents attackers from leveraging CSS-based attack vectors while maintaining the application's visual functionality for legitimate color specifications.
The remediation strategy demonstrates proper security engineering practices by implementing both input validation and output sanitization techniques. The transition from string-based HTML construction to DOM node creation with textContent ensures that all user-visible content is treated as literal text rather than executable markup, fundamentally eliminating the XSS attack surface. The restriction on tag colors represents a defense-in-depth approach that addresses potential bypass opportunities in CSS parsing, preventing attackers from exploiting seemingly benign features to deliver malicious payloads. These changes collectively address the root cause of the vulnerability while maintaining application functionality and user experience, providing comprehensive protection against remote code execution through manipulated data inputs.