Stored Cross-Site Scripting Vulnerability in CTI Transmute by MISP
CVE-2026-9806

6.3MEDIUM

Key Information:

Vendor

Misp

Status
Cti-transmute
Vendor
CVE Published:
28 May 2026

Badges

👾 Exploit Exists🟡 Public PoC

What is CVE-2026-9806?

A stored cross-site scripting vulnerability exists in the notification panel of CTI Transmute. This issue arises when notification messages containing user-controlled convert names are displayed using innerHTML without sufficient sanitization measures. An attacker could exploit this by crafting a malicious convert name to inject arbitrary JavaScript code. This code would execute within the browser context of an authenticated user when they interacted with the notification panel. Successful exploitation can lead to unauthorized actions or information exposure. The vulnerability was remediated by using secure practices, such as constructing notification elements through DOM methods and using textContent to present notification message content.

Affected Version(s)

cti-transmute 1.0

Exploit Proof of Concept (PoC)

PoC code is written by security researchers to demonstrate the vulnerability can be exploited. PoC code is also a key component for weaponization which could lead to ransomware.

CVE-2026-9806
Created by aj2108

References

https://github.com/MISP/cti-transmute/commit/cf42409badc2...
patch

CVSS V4

Score:
6.3
Severity:
MEDIUM
Confidentiality:
Low
Integrity:
None
Availability:
None
Attack Vector:
Network
Attack Complexity:
Low
Attack Required:
Physical
Privileges Required:
Undefined
User Interaction:
None

Timeline

  • 🟡

    Public PoC available

  • 👾

    Exploit known to exist

  • Vulnerability published

  • Vulnerability Reserved

Credit

ecrou-exact 🔩
.