Stored Cross-Site Scripting Vulnerability in CTI Transmute by MISP

CVE-2026-9806

What is CVE-2026-9806?

A stored cross-site scripting vulnerability exists in the notification panel of CTI Transmute. This issue arises when notification messages containing user-controlled convert names are displayed using innerHTML without sufficient sanitization measures. An attacker could exploit this by crafting a malicious convert name to inject arbitrary JavaScript code. This code would execute within the browser context of an authenticated user when they interacted with the notification panel. Successful exploitation can lead to unauthorized actions or information exposure. The vulnerability was remediated by using secure practices, such as constructing notification elements through DOM methods and using textContent to present notification message content.

References