CVE-2026-73161
Received Received - Intake

Cross-Site Scripting in cti-transmute via Highlight Feature

Publication date: 2026-08-11

Last updated on: 2026-08-11

Assigner: 5a6e4751-2f3f-4070-9419-94fb35b644e8

Description
Affected versions of cti-transmute improperly handle conversion-table values passed through the search highlighting feature. The highlight() function previously returned the underlying text directly when no search query was supplied, or performed a regex replacement that inserted <mark> tags without first escaping the original content. Because the resulting value is used by an HTML-rendering sink, malicious markup contained in conversion data could be interpreted as HTML rather than displayed as text. The fix introduces a shared highlightMatches() helper that first converts special characters such as <, >, &, and quotes into HTML entities. Only after escaping does the code insert the application-controlled <mark> element used for search highlighting.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-08-11
Last Modified
2026-08-11
Generated
2026-08-11
AI Q&A
2026-08-11
EPSS Evaluated
N/A
NVD
CVE-2026-73161
EUVD
EUVD-2026-55993

Affected Vendors & Products

Showing 2 associated CPEs
Vendor Product Version / Range
cti-transmute cti-transmute *
misp cti-transmute to 5a6e4751-2f3f-4070-9419-94fb35b644e8 (inc)

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-79 The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.
CWE-116 The product prepares a structured message for communication with another component, but encoding or escaping of the data is either missing or done incorrectly. As a result, the intended structure of the message is not preserved.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This vulnerability affects cti-transmute versions that improperly handle conversion-table values in the search highlighting feature. The highlight() function either returned raw text without a search query or inserted unescaped user input with <mark> tags via regex replacement. This allows malicious markup in conversion data to be interpreted as HTML instead of displayed as text, enabling cross-site scripting (XSS) attacks.

Detection Guidance

To detect this vulnerability, inspect the cti-transmute application for improper handling of conversion-table values in search highlighting. Check if user-controlled input is directly inserted into HTML without escaping. Review the searchHighlight.js and conversionTable.js files for the presence of the highlightMatches helper function and proper HTML entity encoding.

Impact Analysis

An attacker could exploit this to inject malicious scripts into web pages rendered by cti-transmute. This could lead to theft of sensitive data, session hijacking, or defacement of the website. Users interacting with the affected system might unknowingly execute harmful scripts.

Compliance Impact

This vulnerability could lead to unauthorized access or disclosure of personal data, violating GDPR's integrity and confidentiality principles. For HIPAA, it may risk exposing protected health information, potentially leading to compliance breaches and legal penalties.

Mitigation Strategies

Apply the patch from the provided commit to update the highlightMatches function in searchHighlight.js. Ensure all conversion-table cells and search queries are properly escaped using HTML entities before rendering. Replace any direct regex replacements in conversionTable.js with calls to the new helper function.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-73161. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart