EUVD-2026-55973
GHSA-fq55-48v3-mc95
Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:L/VI:L/VA:N/SC:L/SI:L/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Network-delivered stored XSS with no privilege prerequisite requiring passive user interaction; scope changes to browser context with limited confidentiality and integrity impact and no availability effect.
Primary rating from Vendor (5a6e4751-2f3f-4070-9419-94fb35b644e8).
CVSS VectorVendor: 5a6e4751-2f3f-4070-9419-94fb35b644e8
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:L/VI:L/VA:N/SC:L/SI:L/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Lifecycle Timeline
2DescriptionCVE.org
Affected versions of cti-transmute fail to HTML-escape attacker-controlled values used in ECharts Sunburst and Treemap tooltip formatters. Slice names may originate directly from STIX or MISP data, including STIX types, relationship_type, pattern prefixes, and MISP category/type values. Since ECharts interprets the formatter return value as HTML, crafted values can inject markup or script-capable content into the tooltip.
An attacker who can cause malicious conversion data to be processed can therefore inject content that executes when another user views the visualization and hovers over the affected slice. The patch replaces direct interpolation with dedicated formatter functions that call escapeHtml() on p.name, p.data.value, and p.value.
AnalysisAI
Stored cross-site scripting in MISP's cti-transmute visualization engine allows an attacker who can supply crafted STIX or MISP data to inject arbitrary HTML and JavaScript into ECharts Sunburst and Treemap tooltips, executing in a victim analyst's browser when they hover over an affected chart slice. All versions of cti-transmute prior to upstream fix commit c5b024a8ef5632f8939cfe2dad9026064698f4bb are affected, with vulnerable field values including STIX type, relationship_type, pattern prefix, and MISP category and type - all attacker-controllable in a shared threat intelligence environment. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Exploitation requires two concrete conditions to be met simultaneously. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The CVSS 4.0 score of 5.3 reflects moderate severity, shaped by network accessibility and low attack complexity offset by the passive user interaction requirement - the victim must hover over a chart slice to trigger the tooltip, which limits opportunistic mass exploitation. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | A threat intelligence contributor submits a STIX bundle containing an object whose relationship_type or type field is set to a value embedding an HTML script payload or an injected event-handler attribute. When a cti-transmute analyst opens the visualization derived from this bundle and moves their cursor over the poisoned chart slice, ECharts invokes the unpatched formatter, renders the injected markup as HTML in the tooltip layer, and executes the attacker's script within the analyst's browser session. … |
| Remediation | The primary fix is to update cti-transmute to a build incorporating upstream commit c5b024a8ef5632f8939cfe2dad9026064698f4bb, available at https://github.com/MISP/cti-transmute/commit/c5b024a8ef5632f8939cfe2dad9026064698f4bb. … Detailed patch versions, workarounds, and compensating controls in full report. |
Threat intelligence, references, and detailed analysis are available after sign-in.
Same weakness CWE-79 – Cross-site Scripting (XSS)
View allShare
External POC / Exploit Code
Leaving vuln.today