CVE-2026-35212
Cross-Site Scripting in OpenCTI Platform
Publication date: 2026-06-02
Last updated on: 2026-06-02
Assigner: GitHub, Inc.
Description
Description
CVSS Scores
EPSS Scores
| Probability: | |
| Percentile: |
Meta Information
Affected Vendors & Products
| Vendor | Product | Version / Range |
|---|---|---|
| opencti | opencti | to 7.260227.0 (exc) |
Helpful Resources
Exploitability
| CWE ID | Description |
|---|---|
| CWE-79 | The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users. |
Attack-Flow Graph
AI Powered Q&A
Can you explain this vulnerability to me?
This vulnerability affects OpenCTI, an open source platform for managing cyber threat intelligence. Versions prior to 7.260227.0 are vulnerable to a Cross-Site Scripting (XSS) issue in the rendering of the email-message observable body data. Specifically, the content of the body field is not properly sanitized when displayed, which means malicious scripts could be executed if an attacker shares specially crafted data.
Exploitation requires user interaction, such as a user viewing the malicious content. The vulnerability could be exploited by someone sharing STIX data or through any ingester, potentially leading to Cross-Site Request Forgery (CSRF) and large scale session theft.
The issue was fixed in version 7.260227.0.
How can this vulnerability impact me? :
This vulnerability can lead to significant security risks including Cross-Site Request Forgery (CSRF) attacks and large scale session theft. An attacker could exploit the XSS vulnerability to execute malicious scripts in the context of a victim's browser, potentially hijacking user sessions and gaining unauthorized access to sensitive information or functionalities within the OpenCTI platform.
What immediate steps should I take to mitigate this vulnerability?
To mitigate this vulnerability, upgrade OpenCTI to version 7.260227.0 or later, as this version contains the fix for the XSS issue in the rendering of email-message observable body data.
Additionally, be cautious with user interactions involving shared STIX data or any ingester, as exploitation requires user interaction.
How does this vulnerability affect compliance with common standards and regulations (like GDPR, HIPAA)?:
The vulnerability in OpenCTI allows for cross-site scripting (XSS) that can lead to cross-site request forgery (CSRF) and large scale session theft. Such security issues could potentially expose sensitive user data or session information.
However, the provided information does not specify any direct impact or implications regarding compliance with common standards and regulations such as GDPR or HIPAA.