CVE-2026-73159

cti-transmute Stored XSS via Crafted Tag Icon on Admin Triage Interface

MEDIUM

5.1

CVSS Score

Published: August 11, 2026 at 08:45 AM UTC

Updated: October 24, 2026 at 03:10 PM UTC

1 product affected across 1 vendorCTI-Transmute

Using cti-transmute by MISP?

Get instant alerts when new vulnerabilities affect cti-transmute - before attackers find them.

Real-time alertsTrack your software stackFree plan available

Start Free Sign In

Severity

MEDIUM5.1

Exploit prediction

EPSS 0.4%

SSVC

No known exploit

Description

Affected versions of cti-transmute allow a tag's icon value to be stored and later interpolated into HTML through Vue's v-html. The helper mapIcon() previously constructed an HTML string directly from the icon value: <i class="fas fa-${name}"></i> Because the icon is user-supplied, a crafted value could break out of the intended markup and inject attacker-controlled HTML. When the affected tag was later rendered, including on the administrative triage interface, the payload could execute in the viewer's browser. The patch mitigates the issue at multiple layers: v-html is replaced with Vue :class binding, mapIcon() now returns only a constrained FontAwesome class string, and the backend validates icons against the FontAwesome catalogue or a strict [a-z0-9-]{1,40} slug pattern before storing them.