CVE-2026-72751: CTI-Transmute Stored XSS Vulnerability

CVE-2026-72751 Overview

CTI-Transmute contains a stored cross-site scripting (XSS) vulnerability [CWE-79] in the conversion graph used to visualise converted MISP and STIX content. Attacker-controlled values originating from converted Cyber Threat Intelligence (CTI) data reach multiple HTML-parsing sinks in the graph user interface without sufficient neutralisation. Node labels, node sublabels, edge labels, node properties, edge properties, and node types can contain crafted HTML or JavaScript that executes when a user interacts with the graph.

Critical Impact
A crafted MISP or STIX object can inject executable JavaScript into the CTI-Transmute conversion graph, executing in the victim analyst's browser session when the graph is rendered, hovered, or clicked.

Affected Products

MISP CTI-Transmute (website component)
Pivotick graph rendering library integration
Conversion graph and raw JSON popup features

Discovery Timeline

2026-08-10 - CVE-2026-72751 published to NVD
2026-08-10 - Last updated in NVD database

Technical Details for CVE-2026-72751

Vulnerability Analysis

CTI-Transmute renders converted MISP and STIX data through the Pivotick graph library. Several fields on the parsed graph reach HTML-parsing sinks. Node and edge label rendering uses innerHTML-style operations, so a value such as an HTML element containing an event handler is interpreted as markup rather than displayed as plain text.

A separate sink exists in the Open raw JSON feature. The raw object associated with a graph node is inserted into a new document using document.write() with an interpolated HTML string. Crafted JSON can escape the intended <pre> container and inject executable markup.

An additional set of sinks was later identified in the graph properties panel. Property names, property values, hash algorithm names, child attributes, edge properties, and STIX object types still reached Pivotick's tryResolveHTMLElement, which processes string values via template.innerHTML. This allowed malicious markup to execute when a graph node was hovered or selected.

Root Cause

The underlying issue is missing output encoding when passing attacker-controlled CTI content to a rendering library that interprets strings as HTML. CTI data is inherently untrusted because converted MISP and STIX objects can be authored by external parties, yet values were handed directly to Pivotick's HTML resolvers.

Attack Vector

An attacker crafts a malicious MISP or STIX object containing HTML payloads in fields such as labels, property values, or object types. When an analyst imports the object into CTI-Transmute and views the conversion graph, the payload executes in the analyst's browser context.

javascript

// Patch: escape labels before handing them to Pivotick
// Source: https://github.com/MISP/cti-transmute/commit/b50451a746c9959efa508aeaa4a822d122687e35
import { escapeHtml } from './searchHighlight.js'

export function escapeGraphLabels(parsed) {
    for (const node of parsed?.nodes ?? []) {
        const d = node.data
        if (!d) continue
        if (d.label != null) d.label = escapeHtml(d.label)
        if (d.sublabel != null) d.sublabel = escapeHtml(d.sublabel)
    }
    for (const edge of parsed?.edges ?? []) {
        if (edge.data?.label != null) edge.data.label = escapeHtml(edge.data.label)
    }
}

Detection Methods for CVE-2026-72751

Indicators of Compromise

Imported MISP or STIX objects containing HTML tags, event-handler attributes (for example onerror, onclick), or <script> fragments in label, property, or type fields.
Unexpected outbound requests from analyst browsers immediately after opening the conversion graph or the Open raw JSON popup.
CTI records with STIX object type values that contain characters outside the standard identifier set.

Detection Strategies

Inspect CTI ingestion pipelines for objects whose string fields contain <, >, or JavaScript URI schemes before rendering.
Enable browser Content Security Policy (CSP) reporting to capture inline-script violations from the CTI-Transmute web UI.
Review web server access logs for graph page loads followed by anomalous fetch or XHR activity to unfamiliar destinations.

Monitoring Recommendations

Monitor CTI-Transmute deployments for the presence of patched commits b50451a and d34ccac.
Alert on newly imported CTI objects whose fields fail HTML-neutralisation checks.
Track analyst browser telemetry for script execution originating from CTI-Transmute origins outside expected bundled scripts.

How to Mitigate CVE-2026-72751

Immediate Actions Required

Update CTI-Transmute to a revision that includes both commits b50451a746c9959efa508aeaa4a822d122687e35 and d34ccac5d82a642389390187fb3455112cbce886.
Restrict CTI-Transmute web access to authenticated analysts on trusted networks until patches are applied.
Audit recently imported MISP and STIX objects for HTML or JavaScript content in string fields.

Patch Information

The complete remediation is delivered across two upstream commits. The first patch, GitHub Commit b50451a, HTML-escapes node labels, node sublabels, and edge labels before they are passed to Pivotick, and replaces the raw-JSON popup's interpolated document.write() with DOM construction using textContent. The second patch, GitHub Commit d34ccac, restricts graph node type values to a safe identifier character set and wraps node and edge property values in DOM elements populated through textContent, preventing Pivotick from treating attacker-controlled strings as HTML.

Workarounds

Disable the conversion graph view and the Open raw JSON action for users until both patches are deployed.
Enforce a strict Content Security Policy that forbids inline scripts and event-handler attributes on the CTI-Transmute origin.
Pre-filter incoming CTI objects to reject or sanitise fields containing HTML control characters before conversion.

bash

# Apply both upstream patches
git -C cti-transmute fetch origin
git -C cti-transmute cherry-pick b50451a746c9959efa508aeaa4a822d122687e35
git -C cti-transmute cherry-pick d34ccac5d82a642389390187fb3455112cbce886