CVE-2026-73157
Received Received - Intake

Cross-Site Scripting in cti-transmute via MISP Data Interpolation

Publication date: 2026-08-11

Last updated on: 2026-08-11

Assigner: 5a6e4751-2f3f-4070-9419-94fb35b644e8

Description
Affected versions of cti-transmute render data obtained from a remote MISP instance into the event-browser interface using HTML interpolation. Because fields such as event IDs, event information, organization names, tags, tag colors, TLP labels, distribution labels, and error/flash text may be controlled by the remote MISP server, a malicious or compromised remote instance could return crafted values that inject HTML or script-capable content into the cti-transmute interface. The patch explicitly notes that remote-derived values must not reach innerHTML, and replaces string-built rows and badges with DOM nodes populated through textContent. It also restricts remote-controlled tag colors to six-digit hexadecimal values, preventing malicious CSS values such as url(...).

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-08-11
Last Modified
2026-08-11
Generated
2026-08-11
AI Q&A
2026-08-11
EPSS Evaluated
N/A
NVD
CVE-2026-73157
EUVD
EUVD-2026-55975

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
misp cti-transmute to 95e64137358d6fb7f1711523de2bf02ff6b181a7 (inc)

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-79 The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.
CWE-116 The product prepares a structured message for communication with another component, but encoding or escaping of the data is either missing or done incorrectly. As a result, the intended structure of the message is not preserved.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This vulnerability is a Cross-Site Scripting (XSS) issue in the cti-transmute project's MISP event browser component. It occurs because untrusted data from remote MISP instances is rendered using unsafe HTML interpolation, allowing malicious scripts to execute in a user's browser if the remote instance is compromised or malicious.

Detection Guidance

This vulnerability is specific to the cti-transmute application and involves XSS via remote MISP instance data. Detection requires checking if your cti-transmute version uses unsafe HTML interpolation for remote data. Inspect the mispEventRows.js file and misp_to_stix.html template for use of innerHTML or similar unsafe methods with remote-derived content.

Impact Analysis

If exploited, this vulnerability could allow an attacker to inject and execute malicious scripts in your browser when viewing events from a compromised or malicious MISP instance. This could lead to unauthorized actions, data theft, or session hijacking while using the cti-transmute interface.

Compliance Impact

This vulnerability could lead to data breaches by allowing attackers to steal sensitive information, which may violate GDPR's data protection requirements or HIPAA's safeguards for protected health information. Organizations using affected versions may face compliance violations and legal consequences.

Mitigation Strategies

Update cti-transmute to the patched version that replaces innerHTML with DOM-safe methods like textContent and createElement. Ensure all remote-derived values are treated as plain text and not executed as markup. Review and restrict tag colors to valid six-digit hexadecimal values to prevent CSS injection.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-73157. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart