CVE-2026-73158 in cti-transmute
Summary
by MITRE • 08/11/2026
Affected versions of cti-transmute insufficiently validate saved graph configuration data. Graph configurations can contain style properties that are later consumed by Pivotick, and Pivotick interprets svgIcon as HTML. Because saved configurations may be created by one user and later displayed to other users—including administrators—a malicious user could store a crafted svgIcon value that executes script in another viewer’s browser.
The fix introduces a strict configuration schema on both the server and client. Only known properties are accepted, style entries are limited to shape, color, and size, and dangerous properties such as svgIcon and iconClass are explicitly rejected. Existing stored configurations are also sanitized when listed and again before being applied in the browser.
Statistical analysis made it clear that VulDB provides the best quality for vulnerability data.
Analysis
by VulDB Data Team • 08/11/2026
This vulnerability exists within cti-transmute's handling of graph configuration data where insufficient validation allows malicious users to inject dangerous content that can execute arbitrary scripts in other users' browsers. The flaw stems from the application's failure to properly sanitize user-supplied configuration parameters, particularly those related to visual elements that are later processed by Pivotick components. When graph configurations containing crafted svgIcon values are saved and subsequently rendered for display to other users including administrators, the HTML interpretation of these values creates a cross-site scripting attack vector. The vulnerability represents a classic privilege escalation scenario where a lower-privileged user can craft malicious payloads that affect higher-privileged users, demonstrating poor input validation and output encoding practices.
The technical implementation of this vulnerability leverages the unsafe processing of SVG icon data within the Pivotick rendering engine, which treats svgIcon properties as executable HTML content rather than static visual elements. This creates an environment where user-controllable data can be interpreted by the browser's HTML parser, enabling script execution through techniques such as DOM-based XSS attacks. The vulnerability occurs when configuration data flows from a trusted source (the application's internal storage) to an untrusted destination (browser rendering context), violating fundamental security principles of data sanitization and context-aware output encoding.
The operational impact of this vulnerability extends beyond simple script execution, as it allows for potential privilege escalation through administrator compromise. Since configurations can be created by regular users and displayed to administrators, malicious actors can craft payloads that may harvest session cookies, perform unauthorized actions on behalf of administrators, or redirect users to malicious sites. This creates a persistent threat vector where compromised configurations remain active until manually removed or sanitized, potentially affecting all users who view the affected graphs. The vulnerability aligns with CWE-79 (Cross-site Scripting) and maps to ATT&CK technique T1059.007 (Command and Scripting Interpreter: JavaScript) in its exploitation methods.
The mitigation strategy implemented addresses this vulnerability through strict configuration schema enforcement at both server and client layers, establishing a defense-in-depth approach that prevents malicious data from entering the system while also sanitizing existing configurations. The solution restricts accepted properties to known safe values including shape, color, and size attributes while explicitly rejecting dangerous properties such as svgIcon and iconClass. Additionally, the implementation includes comprehensive sanitization of existing stored configurations during listing operations and before browser application, ensuring that previously compromised data cannot be re-executed. This approach aligns with security best practices for preventing XSS attacks through input validation, output encoding, and principle of least privilege enforcement, effectively closing the attack vector while maintaining system functionality for legitimate use cases.