EUVD-2026-55975
GHSA-fh4x-m2h5-c6vx
Severity by source
CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:P/VC:L/VI:L/VA:N/SC:L/SI:L/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
AC:H because exploitation requires pre-positioned attacker control of the queried MISP server; UI:R for operator browser interaction; S:C for XSS scope change into browser context.
Primary rating from Vendor (CIRCL).
CVSS VectorVendor: CIRCL
CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:P/VC:L/VI:L/VA:N/SC:L/SI:L/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Lifecycle Timeline
2DescriptionCVE.org
Affected versions of cti-transmute render data obtained from a remote MISP instance into the event-browser interface using HTML interpolation. Because fields such as event IDs, event information, organization names, tags, tag colors, TLP labels, distribution labels, and error/flash text may be controlled by the remote MISP server, a malicious or compromised remote instance could return crafted values that inject HTML or script-capable content into the cti-transmute interface.
The patch explicitly notes that remote-derived values must not reach innerHTML, and replaces string-built rows and badges with DOM nodes populated through textContent. It also restricts remote-controlled tag colors to six-digit hexadecimal values, preventing malicious CSS values such as url(...).
AnalysisAI
Cross-site scripting in cti-transmute's MISP event-browser allows a malicious or compromised remote MISP instance to inject arbitrary HTML and JavaScript into the operator's browser by returning crafted values in event data fields. Affected fields include event IDs, event information text, organization names, tags, tag colors, TLP labels, distribution labels, and flash/error messages - all previously interpolated via innerHTML without sanitization. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Exploitation requires that the attacker controls or has compromised the remote MISP instance that the cti-transmute operator is actively querying - specifically, the attacker must be able to set malicious values in MISP event fields (event info, organization name, tags, tag colors, TLP labels, distribution labels, or error/flash text). … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The CVSS 4.0 score of 2.3 (AV:N/AC:L/AT:P/PR:N/UI:P/VC:L/VI:L/VA:N/SC:L/SI:L/SA:N) accurately captures the constrained real-world risk. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | An attacker who operates or has compromised a MISP instance populates event fields such as event info text, organization name, or tag names with JavaScript payloads - for example, an img tag with an onerror handler that exfiltrates document cookies to an attacker-controlled endpoint. When a threat analyst using cti-transmute queries that MISP server and opens the event browser to select events for STIX conversion, the injected payload executes in the analyst's browser, potentially stealing session tokens or pivoting to other browser-accessible resources. … |
| Remediation | Update cti-transmute to a build that includes commit 95e64137358d6fb7f1711523de2bf02ff6b181a7 (https://github.com/MISP/cti-transmute/commit/95e64137358d6fb7f1711523de2bf02ff6b181a7); verify that the patched mispEventRows.js file is present, as no tagged release version has been independently confirmed. … Detailed patch versions, workarounds, and compensating controls in full report. |
Threat intelligence, references, and detailed analysis are available after sign-in.
More in Cti Transmute
View allServer-side request forgery in CTI-Transmute's evaluation report PDF-generation pipeline allows an attacker who can inje
Cross-site request forgery in CTI-Transmute's administrative user deletion endpoint enables unauthenticated remote attac
Uncontrolled resource consumption in CTI-Transmute's unauthenticated /activity_timeline endpoint allows remote attackers
Unauthorized disclosure of deleted-conversion history data in MISP cti-transmute (≤ 1.4.0) stems from a logic inversion
Stored XSS in MISP CTI Transmute's notification bell dropdown allows an attacker who can control convert names to inject
Missing authorization in MISP cti-transmute (versions ≤ 1.4.0) allows any authenticated user to add or remove emoji reac
Private evaluation comment disclosure in MISP's cti-transmute (all versions ≤ 1.4.0) allows any authenticated user with
Cross-site request forgery in MISP cti-transmute exposes four authenticated account endpoints - /account/follow, /accoun
Email address disclosure in MISP cti-transmute versions up to and including 1.4.0 exposes private user email addresses t
Stored Vue template injection in CTI-Transmute ≤ 1.5.0 allows an unauthenticated attacker to execute arbitrary JavaScrip
Stored cross-site scripting in CTI-Transmute's conversion graph allows attacker-controlled CTI content (MISP or STIX obj
Stored cross-site scripting in MISP cti-transmute allows authenticated users to inject arbitrary script into shared grap
Same weakness CWE-79 – Cross-site Scripting (XSS)
View allShare
External POC / Exploit Code
Leaving vuln.today