Stored Cross-Site Scripting Vulnerability in CTI-Transmute by MISP

CVE-2026-72751

What is CVE-2026-72751?

CTI-Transmute is vulnerable to a stored cross-site scripting (XSS) issue due to insufficient neutralization of attacker-controlled values in the conversion graph that visualizes both MISP and STIX content. Malicious inputs could manipulate node labels, edge labels, and other graph attributes to execute arbitrary HTML and JavaScript, potentially allowing attackers to execute scripts through the graph user interface. The vulnerability arises when data from converted CTI sources is improperly parsed and rendered by the Pivotick graph library. Effective remediation steps were introduced including HTML escaping of node labels, restricting graph node types to a secure identifier set, and refactoring JSON handling to use safer DOM methods, thus ensuring that user-generated content is treated as plain text rather than executable markup.

References