CVE-2025-26621 Overview
CVE-2025-26621 affects OpenCTI, an open source cyber threat intelligence platform developed by Citeum. The flaw exists in versions prior to 6.5.2. Any authenticated user granted the manage customizations capability can edit a webhook that executes JavaScript code. An attacker abuses this behavior to trigger prototype pollution in the Node.js process running the OpenCTI frontend. Successful exploitation renders the platform unavailable to legitimate users. The vulnerability is tracked under CWE-94 (Improper Control of Generation of Code) and CWE-1321 (Prototype Pollution). Version 6.5.2 remediates the issue.
Critical Impact
An authenticated user with customization privileges can crash the OpenCTI Node.js frontend server through webhook-based prototype pollution, causing a denial of service across the threat intelligence platform.
Affected Products
- Citeum OpenCTI versions prior to 6.5.2
- OpenCTI frontend Node.js server component
- Deployments exposing the customization/webhook management interface to non-administrative roles
Discovery Timeline
- 2025-05-19 - CVE-2025-26621 published to the National Vulnerability Database
- 2026-06-17 - Last updated in NVD database
Technical Details for CVE-2025-26621
Vulnerability Analysis
OpenCTI supports webhooks that can execute user-supplied JavaScript. The webhook execution path evaluates attacker-controlled code inside the frontend Node.js runtime. Because inputs are not properly isolated from the JavaScript object prototype chain, a crafted payload modifies Object.prototype properties across the running process. Once polluted, downstream code paths encounter unexpected property values, throwing exceptions or entering unrecoverable states that crash the frontend server. The impact is limited to availability, but the polluted process affects every user of the shared frontend instance.
Root Cause
The root cause combines two weaknesses. First, the customization feature permits execution of arbitrary JavaScript via webhook configuration, matching [CWE-94]. Second, the executed code operates without safeguards against prototype chain modification, matching [CWE-1321]. Together these allow a single authorized customization user to corrupt shared runtime state.
Attack Vector
Exploitation requires network access to the OpenCTI web interface and an account holding the manage customizations capability. The attacker edits a webhook definition to include JavaScript that assigns properties to Object.prototype or __proto__. When the webhook is triggered or evaluated, the pollution propagates to the Node.js server. Subsequent object property lookups return the poisoned values, leading the frontend process to crash or hang.
No verified exploit code has been published. Technical details are documented in the GitHub Security Advisory GHSA-gq63-jm3h-374p and the related GHSA-mf88-g2wq-p7qm advisory.
Detection Methods for CVE-2025-26621
Indicators of Compromise
- Unexpected restarts or crashes of the OpenCTI frontend Node.js process shortly after webhook edits
- Webhook configurations containing references to __proto__, prototype, or constructor.prototype
- Audit log entries showing webhook modifications by non-administrator accounts with the manage customizations capability
Detection Strategies
- Review the OpenCTI audit trail for changes to webhook definitions and correlate them with subsequent frontend service failures
- Inspect webhook JavaScript payloads for prototype manipulation patterns before they are saved
- Alert on process termination or unhandled exception events emitted by the OpenCTI Node.js runtime
Monitoring Recommendations
- Enable centralized logging for the OpenCTI frontend and forward stderr and crash traces to your SIEM
- Track the assignment and use of the manage customizations capability across users and groups
- Monitor availability of the OpenCTI web UI with synthetic checks to identify DoS conditions quickly
How to Mitigate CVE-2025-26621
Immediate Actions Required
- Upgrade all OpenCTI deployments to version 6.5.2 or later
- Audit which users and roles hold the manage customizations capability and remove it from accounts that do not require it
- Review existing webhook definitions and remove any containing prototype manipulation constructs
Patch Information
OpenCTI version 6.5.2 fixes the issue by preventing webhook JavaScript from polluting the Node.js prototype chain. Refer to the OpenCTI GitHub Security Advisory GHSA-gq63-jm3h-374p for full remediation guidance and upgrade instructions.
Workarounds
- Restrict the manage customizations capability to trusted administrators only until the upgrade is complete
- Disable webhook features that execute custom JavaScript where they are not operationally required
- Place the OpenCTI frontend behind a process supervisor that restarts the service after crashes to reduce the impact of DoS attempts
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
