EUVD-2026-55993
GHSA-9p42-c923-p9c9
Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:P/VC:L/VI:L/VA:N/SC:L/SI:L/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Low-privilege authentication required to inject conversion data; victim must render output (UI:R); XSS scope change affects browser context beyond the application origin; no availability impact.
Primary rating from Vendor (5a6e4751-2f3f-4070-9419-94fb35b644e8).
CVSS VectorVendor: 5a6e4751-2f3f-4070-9419-94fb35b644e8
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:P/VC:L/VI:L/VA:N/SC:L/SI:L/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Lifecycle Timeline
1DescriptionCVE.org
Affected versions of cti-transmute improperly handle conversion-table values passed through the search highlighting feature. The highlight() function previously returned the underlying text directly when no search query was supplied, or performed a regex replacement that inserted <mark> tags without first escaping the original content. Because the resulting value is used by an HTML-rendering sink, malicious markup contained in conversion data could be interpreted as HTML rather than displayed as text.
The fix introduces a shared highlightMatches() helper that first converts special characters such as <, >, &, and quotes into HTML entities. Only after escaping does the code insert the application-controlled <mark> element used for search highlighting.
AnalysisAI
Cross-site scripting in MISP's cti-transmute library allows an authenticated attacker to inject arbitrary HTML through conversion-table values rendered by the highlight() function. When processing content for search highlighting, the function inserted conversion data directly into an HTML sink without escaping special characters such as <, >, &, and quotes, allowing malicious markup embedded in CTI conversion data to execute in a victim's browser. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | The attacker must hold low-privilege authenticated access (PR:L per the CVSS 4.0 vector) sufficient to write or influence conversion-table values that are later processed by cti-transmute's highlight() function. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:L/UI:P) scores this at 5.1, reflecting moderate but materially constrained risk. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | An authenticated attacker with access sufficient to modify conversion-table values in a cti-transmute deployment embeds malicious HTML such as an image onerror handler or script tag within a field that is subsequently processed by highlight(). When a victim analyst performs a search or browses highlighted CTI data, the unescaped markup executes in their browser under the application's origin, enabling session token exfiltration or action impersonation. … |
| Remediation | Update cti-transmute to the version incorporating commit ac495641ef3ca927676a73ba8f1bcdfd952413df, available at https://github.com/MISP/cti-transmute/commit/ac495641ef3ca927676a73ba8f1bcdfd952413df. … Detailed patch versions, workarounds, and compensating controls in full report. |
Threat intelligence, references, and detailed analysis are available after sign-in.
Same weakness CWE-79 – Cross-site Scripting (XSS)
View allShare
External POC / Exploit Code
Leaving vuln.today