HTML Injection Vulnerability in cti-transmute Tool by MISP

CVE-2026-73156

What is CVE-2026-73156?

The cti-transmute tool by MISP exhibits a vulnerability where it fails to properly HTML-escape attacker-controlled values utilized in ECharts Sunburst and Treemap tooltip formatters. As slice names can directly be sourced from STIX or MISP data, crafted inputs may result in the injection of malicious HTML or script content when users hover over affected visualizations. Attackers capable of influencing the conversion data can exploit this issue to execute arbitrary content, as the ECharts component processes these values without adequate sanitization. A patch has been implemented that replaces risky direct value interpolation with secure formatter functions that incorporate an escapeHtml() method to enhance the tool's resilience against such attacks.

References