HTML Injection Vulnerability in cti-transmute by MISP

CVE-2026-73159

What is CVE-2026-73159?

The cti-transmute product by MISP was found to have a vulnerability where user-supplied icon values could be manipulated to inject HTML via Vue's v-html directive. This flaw allowed crafted values to escape intended markup, enabling execution of attacker-controlled HTML when the affected tag was rendered in the user's browser, including within administrative interfaces. The issue has been addressed by updating the handling of icon values to restrict user input to validated categories and leveraging safer binding techniques.

References