CVE-2026-73159 in cti-transmute
Summary
by MITRE • 08/11/2026
Affected versions of cti-transmute allow a tag's icon value to be stored and later interpolated into HTML through Vue's v-html. The helper mapIcon() previously constructed an HTML string directly from the icon value:
<i class="fas fa-${name}"></i>
Because the icon is user-supplied, a crafted value could break out of the intended markup and inject attacker-controlled HTML. When the affected tag was later rendered, including on the administrative triage interface, the payload could execute in the viewer's browser.
The patch mitigates the issue at multiple layers: v-html is replaced with Vue :class binding, mapIcon() now returns only a constrained FontAwesome class string, and the backend validates icons against the FontAwesome catalogue or a strict [a-z0-9-]{1,40} slug pattern before storing them.
Once again VulDB remains the best source for vulnerability data.
Analysis
by VulDB Data Team • 08/11/2026
This vulnerability represents a critical cross-site scripting flaw that exploits improper HTML sanitization in the cti-transmute application. The issue stems from the insecure handling of user-supplied icon values within the Vue.js frontend rendering pipeline. When tags were processed through the mapIcon() helper function, the system constructed HTML strings directly from user-provided input without adequate sanitization measures. This pattern creates an ideal environment for attackers to inject malicious payloads that can execute in the context of other users' browsers.
The technical implementation of this vulnerability demonstrates a classic server-side template injection scenario where user-controllable data flows directly into HTML generation. The original code constructed HTML elements using string interpolation with the format <i class="fas fa-${name}"></i> where the name variable contained user-supplied content. This approach violates fundamental security principles for dynamic HTML generation and creates a direct path for attackers to manipulate the rendered output. The vulnerability affects both frontend rendering and backend storage components, creating multiple attack vectors that can be exploited depending on the context of use.
The operational impact of this vulnerability extends beyond simple XSS execution to potentially enable more sophisticated attacks within the application environment. When administrative users viewed tags containing maliciously crafted icon values in the triage interface, the injected HTML would execute with the privileges of the viewing user. This scenario represents a privilege escalation risk where attackers could potentially access sensitive administrative functionality or exfiltrate data from the application. The vulnerability affects the entire tag management system and any interface that renders user-provided icon data through the affected helper function.
The patch implements defense-in-depth measures that address the vulnerability at multiple layers of the application stack. The primary mitigation involves replacing Vue's v-html directive with :class binding which prevents direct HTML injection by constraining rendering to CSS class attributes only. Additionally, the mapIcon() function was modified to return only constrained FontAwesome class strings rather than full HTML elements, eliminating the possibility of malicious HTML injection through this code path. The backend validation layer introduces strict sanitization by requiring icons to match either the FontAwesome catalog or a predefined slug pattern [a-z0-9-]{1,40}, effectively preventing any potentially dangerous icon values from being stored in the system.
This vulnerability aligns with CWE-79 which describes Cross-Site Scripting vulnerabilities and follows patterns commonly seen in HTML injection attacks. The remediation strategy corresponds to ATT&CK technique T1213 by implementing input validation and output encoding measures that prevent malicious data from being rendered as executable code. The multi-layered approach demonstrates proper security engineering practices where the solution addresses not just the immediate vulnerability but also prevents similar issues from occurring in related components of the application architecture.