CVE-2026-73157

Name of the Vulnerable Software and Affected Versions cti-transmute (affected versions not specified)

Description The software renders data from a remote MISP instance into the event-browser interface using HTML interpolation. A malicious or compromised remote server can control fields such as event IDs, event information, organization names, tags, tag colors, TLP labels, distribution labels, and error/flash text to inject HTML or script-capable content into the interface. This occurs because remote-derived values are passed to innerHTML and tag colors are not strictly validated, potentially allowing malicious CSS values.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.