CVE-2026-73161

Name of the Vulnerable Software and Affected Versions cti-transmute (affected versions not specified)

Description The software improperly handles conversion-table values within the search highlighting feature. The highlight() function either returns underlying text directly when no search query is provided or performs a regex replacement to insert <mark> tags without escaping the original content. Since the output is processed by an HTML-rendering sink, malicious markup in conversion data can be interpreted as HTML. This occurs because the application fails to convert special characters into HTML entities before inserting highlighting elements.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.