CVE-2026-73159
Received Received - Intake

Stored XSS in cti-transmute via User-Supplied Icon Values

Publication date: 2026-08-11

Last updated on: 2026-08-11

Assigner: 5a6e4751-2f3f-4070-9419-94fb35b644e8

Description
Affected versions of cti-transmute allow a tag's icon value to be stored and later interpolated into HTML through Vue's v-html. The helper mapIcon() previously constructed an HTML string directly from the icon value: <i class="fas fa-${name}"></i> Because the icon is user-supplied, a crafted value could break out of the intended markup and inject attacker-controlled HTML. When the affected tag was later rendered, including on the administrative triage interface, the payload could execute in the viewer's browser. The patch mitigates the issue at multiple layers: v-html is replaced with Vue :class binding, mapIcon() now returns only a constrained FontAwesome class string, and the backend validates icons against the FontAwesome catalogue or a strict [a-z0-9-]{1,40} slug pattern before storing them.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-08-11
Last Modified
2026-08-11
Generated
2026-08-11
AI Q&A
2026-08-11
EPSS Evaluated
N/A
NVD
CVE-2026-73159
EUVD
EUVD-2026-55979

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
misp cti-transmute to 5a6e4751-2f3f-4070-9419-94fb35b644e8 (exc)

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-79 The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This vulnerability in cti-transmute allows a user-supplied tag icon value to be stored and later rendered as HTML via Vue's v-html directive. The original code constructed an HTML string directly from the icon value, enabling an attacker to inject malicious markup that breaks out of the intended formatting. When the affected tag is displayed, such as on the administrative triage interface, the injected payload executes in the viewer's browser, leading to potential cross-site scripting (XSS) attacks.

Detection Guidance

Check for vulnerable cti-transmute versions by inspecting package.json or installed packages for versions prior to the patched commit. Review admin triage pages for tags using v-html with user-supplied icons. Inspect network traffic for unexpected HTML payloads in tag icons.

Impact Analysis

If exploited, this vulnerability could allow an attacker to execute arbitrary JavaScript in the context of a user's browser session. This could lead to theft of session cookies, unauthorized actions on behalf of the user, or defacement of the application. Users with administrative access are particularly at risk if the payload is rendered on the triage interface.

Compliance Impact

This vulnerability could lead to unauthorized access or data breaches, violating GDPR's integrity and confidentiality principles or HIPAA's security requirements for protected health information. Organizations may face regulatory penalties, reputational damage, and loss of customer trust if such an attack occurs.

Mitigation Strategies

Update cti-transmute to the patched commit cc13416d606d91d543ce1f1e41387750f8450153. Ensure backend validates icons against FontAwesome catalogue or regex pattern [a-z0-9-]{1,40}. Replace v-html with Vue :class binding for icon rendering. Remove or sanitize any stored malicious icon payloads.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-73159. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart