CVE-2026-73156
Received Received - Intake

HTML Injection in cti-transmute ECharts Visualization

Publication date: 2026-08-11

Last updated on: 2026-08-11

Assigner: 5a6e4751-2f3f-4070-9419-94fb35b644e8

Description
Affected versions of cti-transmute fail to HTML-escape attacker-controlled values used in ECharts Sunburst and Treemap tooltip formatters. Slice names may originate directly from STIX or MISP data, including STIX types, relationship_type, pattern prefixes, and MISP category/type values. Since ECharts interprets the formatter return value as HTML, crafted values can inject markup or script-capable content into the tooltip. An attacker who can cause malicious conversion data to be processed can therefore inject content that executes when another user views the visualization and hovers over the affected slice. The patch replaces direct interpolation with dedicated formatter functions that call escapeHtml() on p.name, p.data.value, and p.value.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-08-11
Last Modified
2026-08-11
Generated
2026-08-11
AI Q&A
2026-08-11
EPSS Evaluated
N/A
NVD
CVE-2026-73156
EUVD
EUVD-2026-55973

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
misp cti-transmute to 5a6e4751-2f3f-4070-9419-94fb35b644e8 (exc)

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-79 The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This vulnerability is a Cross-Site Scripting (XSS) flaw in the cti-transmute library. It occurs because the tool fails to escape HTML in tooltip formatters for ECharts Sunburst and Treemap visualizations. Attacker-controlled data, such as slice names from STIX or MISP data, can inject malicious markup or scripts into tooltips. When users hover over affected slices, the injected content executes.

Detection Guidance

Check if your cti-transmute version is affected by inspecting the Sunburst and Treemap tooltip formatters in the ConversionSunburst Vue component. Look for direct interpolation of user-controlled values without HTML escaping.

Impact Analysis

If you use or host a system that relies on cti-transmute for visualizations, an attacker could exploit this to run malicious scripts in your users' browsers. This could lead to session hijacking, data theft, or defacement of your visualization pages. The impact depends on user privileges and data sensitivity.

Compliance Impact

This XSS vulnerability could expose personal or sensitive data if exploited, violating GDPR's integrity and confidentiality principles or HIPAA's security requirements. Organizations may face compliance penalties if user data is compromised due to inadequate input sanitization.

Mitigation Strategies

Update to the patched version of cti-transmute that includes the new formatter functions sunburstTooltipFormatter and treemapTooltipFormatter which escape HTML. Alternatively, manually apply the escapeHtml utility to tooltip formatter outputs.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-73156. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart