CVE-2026-73157
LowCVSS 2.3Exploitation Probability (EPSS)
Low risk18th percentile - higher than 18% of all known CVEs
Summary
The vulnerability in cti-transmute renders data from a remote MISP instance into the event-browser interface using HTML interpolation. A malicious or compromised MISP server can return crafted values that inject HTML or script-capable content into the interface.
Risk Assessment
The risk includes the possibility of script execution in the user's browser (XSS), which could lead to session theft or other attacks.
Recommendation
Apply the patch immediately, which uses textContent instead of innerHTML and restricts remote-controlled tag colors to six-digit hex values.
Original NVD description (English source)
Affected versions of cti-transmute render data obtained from a remote MISP instance into the event-browser interface using HTML interpolation. Because fields such as event IDs, event information, organization names, tags, tag colors, TLP labels, distribution labels, and error/flash text may be controlled by the remote MISP server, a malicious or compromised remote instance could return crafted values that inject HTML or script-capable content into the cti-transmute interface. The patch explicitly notes that remote-derived values must not reach innerHTML, and replaces string-built rows and badges with DOM nodes populated through textContent. It also restricts remote-controlled tag colors to six-digit hexadecimal values, preventing malicious CSS values such as url(...).