EJS Template Injection Vulnerability in OpenCTI by OpenCTI

CVE-2026-39980

What is CVE-2026-39980?

OpenCTI, an open-source platform for managing cyber threat intelligence, is susceptible to an EJS template injection vulnerability found in versions prior to 6.9.5. This flaw allows users with the Manage customization capability to execute arbitrary JavaScript code within the context of the OpenCTI platform process during notifier template execution. The issue arises due to improper sanitization of EJS templates in the safeEjs.ts file, which can potentially compromise the integrity of the application. Users are advised to upgrade to version 6.9.5 or later to mitigate this security risk. More information can be found in the security advisory and the release notes.

References