Stored Cross-Site Scripting Vulnerability in CTI-Transmute by CTI

CVE-2026-71502

What is CVE-2026-71502?

CTI-Transmute is vulnerable to a stored cross-site scripting issue due to inadequate neutralization of user-controlled data within Vue template expressions. An unauthenticated attacker can exploit this vulnerability by crafting a public conversion with malicious content, specifically using Vue’s expression delimiters. Despite Jinja HTML escaping, the browser interprets these expressions as executable JavaScript rather than plain text. This can lead to unauthorized actions, potentially compromising sensitive information such as API keys or user sessions. The issue affects all users who access the affected pages, especially administrators, thus escalating the potential impact. The vulnerability has been addressed by implementing a global Jinja hook to manipulate Vue delimiters, rendering them safe from execution.

References