CVE-2026-73156: cti-transmute XSS Vulnerability

CVE-2026-73156 Overview

CVE-2026-73156 is a stored Cross-Site Scripting (XSS) vulnerability [CWE-79] in the MISP cti-transmute project. The flaw exists in the ECharts Sunburst and Treemap tooltip formatters used to render STIX and MISP conversion visualizations. Affected versions fail to HTML-escape attacker-controlled slice values before returning them to ECharts, which interprets the formatter output as HTML. An attacker who supplies crafted STIX types, relationship_type, pattern prefixes, or MISP category/type values can inject markup that executes when another user hovers over the affected slice.

Critical Impact
Malicious CTI data can execute script-capable content in an analyst's browser session when they interact with the conversion visualization.

Affected Products

MISP cti-transmute — website visualization component (conversionSunburst.js)
ECharts Sunburst tooltip formatter integrations in cti-transmute
ECharts Treemap tooltip formatter integrations in cti-transmute

Discovery Timeline

2026-08-11 - CVE-2026-73156 published to NVD
2026-08-11 - Last updated in NVD database

Technical Details for CVE-2026-73156

Vulnerability Analysis

The vulnerability resides in the client-side visualization code that renders converted Cyber Threat Intelligence (CTI) data as Sunburst and Treemap charts. ECharts allows applications to supply a formatter function whose return value is rendered as HTML inside the tooltip element. Affected versions of cti-transmute directly interpolate slice metadata such as p.name, p.data.value, and p.value into the returned string without sanitization. Because these fields originate from user-supplied STIX or MISP objects, an operator ingesting adversary-controlled data can trigger script execution when an analyst hovers over a chart slice.

The issue affects any workflow where untrusted CTI is converted and rendered in the browser. Impact is limited to the browser context of the viewing user, but it can expose session data, MISP API tokens available to the page, and cross-tenant intelligence content.

Root Cause

The formatter functions did not call an HTML-escaping helper before returning strings that ECharts renders as HTML. Slice names inherited from STIX types, STIX relationship_type, STIX pattern prefixes, and MISP category/type values were passed through unchanged. Because these fields are commonly populated from external feeds, an attacker who controls a submitted CTI object controls markup rendered inside the tooltip.

Attack Vector

An attacker submits a STIX or MISP object containing HTML or script-capable content in a field used as a slice label. When an analyst loads the affected visualization and hovers over the poisoned slice, the injected content is interpreted as HTML. Exploitation requires user interaction (hover) but no authentication on the attacker's side beyond the ability to have their CTI data ingested and converted.

javascript

// Patch: website/web/static/js/graph/conversionSunburst.js
// fix: [website] Neutralise the Sunburst tooltip XSS on slice hover
-import JsonViewer from '/static/js/graph/jsonViewer.js'
+import JsonViewer from './jsonViewer.js'
+import { escapeHtml } from './searchHighlight.js'

const PALETTE = [
    '#3b82f6', '#8b5cf6', '#10b981', '#f59e0b', '#ef4444',
// Source: https://github.com/MISP/cti-transmute/commit/c5b024a8ef5632f8939cfe2dad9026064698f4bb

The patch introduces escapeHtml() from searchHighlight.js and applies it to p.name, p.data.value, and p.value inside dedicated formatter functions, replacing direct string interpolation.

Detection Methods for CVE-2026-73156

Indicators of Compromise

STIX or MISP objects whose name, type, relationship_type, or pattern prefix fields contain angle brackets, <script> tags, event handler attributes such as onerror=, or javascript: URIs.
MISP category or type values that include HTML entities or encoded markup uncharacteristic of normal taxonomy values.
Browser console errors or unexpected network requests originating from the CTI visualization page after hovering over chart slices.

Detection Strategies

Inspect ingested CTI feeds for fields containing HTML metacharacters and quarantine objects that fail a strict allowlist for STIX and MISP field formats.
Enable and monitor Content Security Policy (CSP) violation reports on the cti-transmute web interface to surface inline script execution attempts.
Review web server and application logs for unusual POST traffic to CTI ingestion endpoints followed by analyst page loads of conversion visualizations.

Monitoring Recommendations

Alert on outbound requests from analyst browsers to unknown domains when the CTI visualization page is active.
Track versions of cti-transmute deployed across analyst workstations and web servers to confirm all instances are patched.
Monitor MISP audit logs for new or modified events whose fields include HTML or script content and correlate with subsequent user access to conversion views.

How to Mitigate CVE-2026-73156

Immediate Actions Required

Upgrade cti-transmute to a version that includes commit c5b024a or later, which introduces escapeHtml() sanitization of tooltip values.
Restrict access to the CTI conversion web interface to trusted analysts while patching is deployed.
Audit recently ingested STIX and MISP objects for fields containing HTML or script content and remove any suspect entries.

Patch Information

The fix is available in the upstream repository. Refer to the MISP cti-transmute security commit c5b024a for the code change. The patch replaces direct interpolation in the Sunburst and Treemap formatters with dedicated functions that call escapeHtml() on p.name, p.data.value, and p.value.

Workarounds

Disable the Sunburst and Treemap visualization views in cti-transmute until the patched version is deployed.
Deploy a strict Content Security Policy on the cti-transmute web application that blocks inline scripts and untrusted event handlers.
Validate and sanitize incoming CTI fields at the ingestion layer to reject values containing HTML metacharacters in STIX types, relationship_type, pattern prefixes, and MISP category or type fields.

bash

# Example: pull and deploy the patched cti-transmute revision
git fetch origin
git checkout c5b024a8ef5632f8939cfe2dad9026064698f4bb
# Restart the web service serving the visualization
systemctl restart cti-transmute