XSS Vulnerability in OpenCTI Platform by OpenCTI

CVE-2026-35212

What is CVE-2026-35212?

OpenCTI is an open-source platform designed for managing cyber threat intelligence. It has a vulnerability where versions prior to 7.260227.0 inadequately sanitize the content of the email-message observable body data, allowing an XSS attack to potentially occur. Although exploitation requires user interaction, it could enable an attacker to execute malicious scripts, leading to Cross-Site Request Forgery (CSRF) and potentially result in extensive session theft. Users are urged to upgrade to version 7.260227.0 or later to mitigate this risk.

References