cti-transmute CVE-2026-73157

Exploitation requires that the attacker controls or has compromised the remote MISP instance that the cti-transmute operator is actively querying - specifically, the attacker must be able to set malicious values in MISP event fields (event info, organization name, tags, tag colors, TLP labels, distribution labels, or error/flash text). The operator must then open the cti-transmute event-browser interface to view the crafted events. No special cti-transmute configuration beyond its standard use against a MISP server is required. Limiting factors: the vulnerability is not exploitable against operators who query only trusted, self-controlled MISP instances; active browsing of the event list by the operator is required (UI:P); and the secondary CSS injection vector via tag colors is further constrained to versions where color values were not validated against a hex pattern.

The CVSS 4.0 score of 2.3 (AV:N/AC:L/AT:P/PR:N/UI:P/VC:L/VI:L/VA:N/SC:L/SI:L/SA:N) accurately captures the constrained real-world risk. AT:P (attack target presence) reflects the hard prerequisite that the attacker must control the queried MISP server - this is not an opportunistic internet-scale attack. UI:P indicates the operator must passively browse the event list for the payload to fire. The limited VC:L/VI:L impact reflects the bounded scope of browser-side XSS in a specialized analyst tool rather than a publicly-exposed application. No EPSS data was provided in the source intelligence, and the vulnerability is not listed in CISA KEV. From an SSVC perspective: exploitation is not confirmed in the wild, automation is constrained by the need to pre-position on a MISP instance, and technical impact is partial. This vulnerability is not a broad priority unless an organization operates cti-transmute against external, untrusted, or shared MISP federation instances.

An attacker who operates or has compromised a MISP instance populates event fields such as event info text, organization name, or tag names with JavaScript payloads - for example, an img tag with an onerror handler that exfiltrates document cookies to an attacker-controlled endpoint. When a threat analyst using cti-transmute queries that MISP server and opens the event browser to select events for STIX conversion, the injected payload executes in the analyst's browser, potentially stealing session tokens or pivoting to other browser-accessible resources. No public proof-of-concept exploit code has been identified at time of analysis.