CVE-2026-73157 Overview
CVE-2026-73157 is a cross-site scripting (XSS) vulnerability in cti-transmute, a component that renders data pulled from remote Malware Information Sharing Platform (MISP) instances. Affected versions interpolate remote-controlled fields directly into the event-browser interface using HTML rendering. A malicious or compromised remote MISP server can return crafted values in event IDs, event information, organization names, tags, tag colors, Traffic Light Protocol (TLP) labels, distribution labels, or error text. These values can inject HTML or script-capable content into the cti-transmute interface, affecting users who load data from the untrusted source.
Critical Impact
A hostile remote MISP instance can inject HTML or script content into any cti-transmute client that consumes its data, enabling client-side code execution in the analyst's browser context.
Affected Products
- MISP cti-transmute (versions prior to the fix in commit 95e6413)
Discovery Timeline
- 2026-08-11 - CVE-2026-73157 published to the National Vulnerability Database (NVD)
- 2026-08-11 - Last updated in NVD database
Technical Details for CVE-2026-73157
Vulnerability Analysis
The flaw is a classic DOM-based XSS pattern classified as [CWE-79]. The cti-transmute client fetches event data from a remote MISP instance and constructs UI elements by concatenating strings into innerHTML. Because the strings originate from a remote source, any HTML or JavaScript embedded in fields such as event information, organization names, or tags is parsed and executed by the browser.
The attack surface spans many rendered fields: event identifiers, event descriptions, organization names, tag names, tag colors, TLP markings, distribution labels, and flash or error messages. Tag colors are particularly relevant because they flow into inline CSS. Without validation, an attacker can supply CSS values such as url(...) to trigger external resource loads or CSS-based attacks.
Exploitation requires an analyst to consume data from a hostile or compromised MISP instance. Threat-intelligence workflows routinely aggregate feeds from third parties, so this trust boundary is realistic. Successful exploitation runs script in the analyst's browser session, enabling session theft, data exfiltration, or pivoting within the analyst workstation.
Root Cause
Remote-derived values reach innerHTML without sanitization. Rows and badges in the event browser are built through string concatenation rather than DOM APIs that treat content as text.
Attack Vector
The attack requires network access to deliver crafted MISP responses and user interaction to render them in the cti-transmute UI. See the GitHub Commit for CTI Transmute for the specific fields and code paths affected.
Detection Methods for CVE-2026-73157
Indicators of Compromise
- MISP event fields containing HTML tags, <script> elements, on* event handlers, or javascript: URIs.
- Tag color values that are not strict six-digit hexadecimal strings, especially values containing url(, expression(, or CSS function calls.
- Outbound requests from analyst browsers to unexpected domains shortly after loading remote MISP data.
Detection Strategies
- Inspect ingested MISP payloads at the network or proxy layer for HTML control characters in fields expected to be plain text.
- Log and review the origin MISP instances that supply events to cti-transmute and flag newly added or untrusted sources.
- Correlate browser-side content security policy (CSP) violation reports with analyst workstation activity.
Monitoring Recommendations
- Monitor endpoints running the cti-transmute client for unexpected script execution or outbound connections initiated from the browser process.
- Track version and commit hash of deployed cti-transmute installations to confirm patched status.
- Alert on new remote MISP synchronization sources being added to any environment.
How to Mitigate CVE-2026-73157
Immediate Actions Required
- Update cti-transmute to a version containing commit 95e64137358d6fb7f1711523de2bf02ff6b181a7 or later.
- Restrict cti-transmute synchronization to trusted, authenticated MISP instances only.
- Review historical event data ingested from untrusted sources for embedded HTML or script content.
Patch Information
The upstream patch removes innerHTML usage for remote-derived values and replaces string-built rows and badges with DOM nodes populated through textContent. It also restricts remote-controlled tag colors to strict six-digit hexadecimal values, blocking CSS injection vectors such as url(...). Details are available in the GitHub Commit for CTI Transmute.
Workarounds
- Disable synchronization from any remote MISP instance that is not fully trusted until the patch is applied.
- Enforce a strict Content Security Policy on the hosting page to block inline script execution and unauthorized external resource loads.
- Isolate the analyst browser sessions used for MISP review from privileged accounts and sensitive systems.
# Configuration example: upgrade cti-transmute to the patched revision
cd /path/to/cti-transmute
git fetch origin
git checkout 95e64137358d6fb7f1711523de2bf02ff6b181a7
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
