Track vulnerabilities like this one. Sign up free to get alerted when software you use is affected.
8.1

cti-transmute: Malicious data can inject scripts into tooltips

CVE-2026-73156 · published 2 months ago
Summary

A security issue in cti-transmute allows attackers to inject malicious scripts into tooltips when users view certain visualizations. This can happen when an attacker manipulates data that is used to generate the tooltips. To fix this, cti-transmute has been updated to prevent this kind of attack, but users should ensure they are running the latest version to stay protected.

What to do

The CVE record does not list a fixed version. Check the vendor's site or the advisory links below - a fix may already be released.

Affected software
VendorProductAffected versions
misp cti-transmute <= 1.4.0
Original advisory text
cti-transmute Sunburst and Treemap Tooltips Allow Cross-Site Scripting via Crafted Conversion Data
Affected versions of cti-transmute fail to HTML-escape attacker-controlled values used in ECharts Sunburst and Treemap tooltip formatters. Slice names may originate directly from STIX or MISP data, including STIX types, relationship_type, pattern prefixes, and MISP category/type values. Since ECharts interprets the formatter return value as HTML, crafted values can inject markup or script-capable content into the tooltip.


An attacker who can cause malicious conversion data to be processed can therefore inject content that executes when another user views the visualization and hovers over the affected slice. The patch replaces direct interpolation with dedicated formatter functions that call escapeHtml() on p.name, p.data.value, and p.value.
References
Fix within
Internet-facing 60 days
Internal At next upgrade
  • Not known to be exploited
  • Needs hands-on effort to exploit
  • Gives an attacker partial control
Severity
8.1 High
Exploitation
<1% chance of attack within 30 days
Type
CWE-79Cross-site Scripting (XSS)
Timeline
Published11 Aug 2026
Updated4 Nov 2026
First seen11 Aug 2026
Sources
CVE-2026-73156 · NVD
CVE-2026-73156 · MITRE
CVE-2026-73156 · OSV
Track software like this
Free during beta