What is the CVSS score of CVE-2026-39980?

CVE-2026-39980 has a CVSS 3.1 base score of 9.1 (Critical). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H. EPSS exploitation probability: 0.1%.

Which versions of OpenCTI are affected by CVE-2026-39980?

OpenCTI versions prior to 6.9.5 contain a server-side template injection vulnerability that allows authenticated administrators with customization permissions to execute arbitrary code within the…. A patch is available.

How to fix or mitigate CVE-2026-39980?

Within 24 hours: Identify all OpenCTI deployments and their current versions; verify no versions prior to 6.9.5 are in production use. Within 7 days: Apply vendor-released patch to upgrade to OpenCTI 6.9.5 or later across all instances; test patch in non-production environment first. Within 30 days: Audit administrator access logs for the 'Manage customization' capability; review any template modifications made by privileged accounts; implement role-based access controls to restrict customization permissions to minimum required users.

OpenCTI CVE-2026-39980

EUVD-2026-20972 CRITICAL

Improper Neutralization of Special Elements Used in a Template Engine (CWE-1336)

2026-04-09 GitHub_M

Ssti Information Disclosure

9.1

CVSS 3.1 · GitHub Advisory

Severity by source

GitHub Advisory PRIMARY

9.1 CRITICAL

AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H

Primary rating from GitHub Advisory · only source for this CVE.

CVSS VectorGitHub Advisory

CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H

Attack Vector

Network

Attack Complexity

Low

Privileges Required

High

User Interaction

None

Scope

Changed

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Updated

Apr 22, 2026 - 00:42 vuln.today

v2 (cvss_changed)

Re-analysis Queued

Apr 22, 2026 - 00:37 vuln.today

cvss_changed

Analysis Updated

Apr 16, 2026 - 05:44 EUVD-patch-fix

executive_summary

Re-analysis Queued

Apr 16, 2026 - 05:29 backfill_euvd_patch

patch_released

Patch available

Apr 16, 2026 - 05:29 EUVD

6.9.5

EUVD ID Assigned

Apr 09, 2026 - 17:45 euvd

EUVD-2026-20972

Analysis Generated

Apr 09, 2026 - 17:45 vuln.today

CVE Published

Apr 09, 2026 - 16:54 nvd

CRITICAL 9.1

DescriptionGitHub Advisory

OpenCTI is an open source platform for managing cyber threat intelligence knowledge and observables. Prior to 6.9.5, the safeEjs.ts file does not properly sanitize EJS templates. Users with the Manage customization capability can run arbitrary JavaScript in the context of the OpenCTI platform process during notifier template execution. This vulnerability is fixed in 6.9.5.

Articles & Coverage 1

yousofnahya.medium.com CVE-2026-39980: Vulnerability Analysis and Proof of Concept Apr 14, 2026

AnalysisAI

Server-Side Template Injection in OpenCTI notifier templates allows privileged administrators with 'Manage customization' capability to execute arbitrary JavaScript in the platform process context. Affecting all versions prior to 6.9.5, this vulnerability permits authenticated high-privilege users to achieve complete system compromise through unsafe EJS template rendering in safeEjs.ts. No public exploit code identified and EPSS score of 0.07% indicates low observed exploitation probability, but CVSS 9.1 Critical rating reflects the total technical impact once privileged access is obtained. Vendor patch released in version 6.9.5.

Technical ContextAI

OpenCTI is a cyber threat intelligence platform built on Node.js that uses EJS (Embedded JavaScript) templating for customizable notification templates. The vulnerability stems from CWE-1336 (Improper Neutralization of Special Elements Used in a Template Engine), specifically affecting the safeEjs.ts module responsible for rendering user-provided EJS templates. When administrators with customization privileges create or modify notifier templates, the platform fails to properly sanitize template expressions, allowing injection of arbitrary JavaScript code. This Server-Side Template Injection (SSTI) executes in the Node.js process context with full platform privileges, bypassing the intended sandbox restrictions that should limit template capabilities to safe data interpolation only.

RemediationAI

Upgrade immediately to OpenCTI version 6.9.5 or later, released February 2026, which includes fixes for the unsafe template sanitization in safeEjs.ts. Release details at https://github.com/OpenCTI-Platform/opencti/releases/tag/6.9.5. For organizations unable to upgrade immediately, implement strict compensating controls: (1) Audit and remove 'Manage customization' capability from all accounts except a minimal set of fully-trusted platform administrators-this reduces attack surface but limits operational flexibility for distributed teams. (2) Enable comprehensive audit logging for all notifier template creation and modification events, with real-time alerting on template changes-adds detection capability but does not prevent exploitation. (3) If feasible, disable custom notifier templates entirely and use only built-in notification formats-this eliminates the attack vector but may break existing workflows dependent on customized notifications. Review the GitHub advisory for any additional vendor-recommended mitigations. All workarounds trade functionality for security; patching to 6.9.5 is the only complete remediation.