cti-transmute CVE-2026-73158

Exploitation requires the attacker to hold an authenticated account on the target cti-transmute instance with permission to save graph configurations, corresponding to PR:L in the CVSS 4.0 vector - unauthenticated attackers cannot exploit this flaw. The victim must be a separate authenticated user, ideally an administrator, who triggers rendering of the stored configuration through the listing view or by applying the config, consistent with UI:P in the CVSS 4.0 vector. The specific vulnerable condition is the Pivotick svgIcon property being processed as HTML rather than a safe identifier, combined with the absence of schema validation at the configuration save and listing endpoints. Deployments where only a single trusted user saves graph configurations are not exploitable because no cross-user trust boundary exists. Single-user or fully isolated cti-transmute instances are also not at risk from this specific stored-XSS path. The non-default-but-expected condition of multiple users sharing one instance is what activates the cross-user injection surface.

The CVSS 4.0 score of 5.1 (Medium) accurately reflects the bounded exploitability: low-privileged authenticated access (PR:L) and passive victim interaction (UI:P) are both required, preventing opportunistic or unauthenticated mass exploitation. EPSS data was not provided in the available intelligence, so automated exploitation probability cannot be quantified. This vulnerability is not listed in the CISA KEV catalog and no public proof-of-concept has been identified, confirming no widespread active exploitation at time of analysis. Despite the moderate score, the admin-targeting attack path is the notable risk amplifier: a contributor-level account can silently stage a payload that executes in an administrator's browser session during a routine config-listing review - even a mid-sized municipal IT team in gliwice running a shared MISP instance with multiple contributors should treat patching as a priority given how routine admin browsing of configurations is. The CVSS 4.0 scope change to SC:L/SI:L confirms that the JavaScript executes in the victim's browser context, enabling session token theft or DOM manipulation beyond the attacker's own session. Because cti-transmute is a niche, security-professional-facing tool rather than mass-market software, the aggregate exposed population is limited, keeping aggregate risk low despite the meaningful per-instance impact.

An authenticated contributor on a shared cti-transmute instance saves a graph configuration containing a crafted svgIcon value such as an img onerror script tag that beacons the viewer's session cookie to an attacker-controlled endpoint. When an administrator later opens the configuration listing as part of normal platform management, Pivotick parses the svgIcon field as HTML, silently executing the script in the administrator's browser and exfiltrating their session token. No public proof-of-concept code has been identified at time of analysis, but the technique requires only standard HTML injection knowledge and no specialized tooling.