CVE-2026-72751

Name of the Vulnerable Software and Affected Versions CTI-Transmute (affected versions not specified)

Description A stored cross-site scripting (XSS) issue exists in the conversion graph used to visualize MISP and STIX content. Attacker-controlled values from converted CTI data are passed to HTML-parsing sinks in the graph user interface without sufficient neutralization. Specifically, node labels, node sublabels, edge labels, node properties, edge properties, and node types can contain crafted HTML or JavaScript. The Pivotick graph library renders these values through HTML-parsing operations, allowing malicious elements with event handlers to be interpreted as markup. Additionally, the Open raw JSON functionality uses document.write() with an interpolated HTML string, enabling crafted JSON to inject executable markup. Further vectors exist in the graph properties panel where the tryResolveHTMLElement function processes string values using template.innerHTML, leading to execution when a graph node is hovered over or selected.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.

As a mitigation measure, implement the following changes: