CVE-2026-73158: cti-transmute XSS Vulnerability

CVE-2026-73158 Overview

CVE-2026-73158 is a stored cross-site scripting (XSS) vulnerability in cti-transmute, a MISP-associated conversion tool. Affected versions insufficiently validate saved graph configuration data. Graph configurations contain style properties consumed by Pivotick, which interprets the svgIcon field as HTML. Because saved configurations may be authored by one user and later displayed to other users, including administrators, a malicious user can store a crafted svgIcon value that executes script in another viewer's browser. The weakness is classified under CWE-20: Improper Input Validation.

Critical Impact
Authenticated low-privilege users can persist script payloads that execute in other users' browsers, including administrator sessions, enabling session theft and privileged action abuse.

Affected Products

MISP cti-transmute (website component) prior to commit 9b317587fa4ec11b6f72c2d1d8b98a686537b4fb
Pivotick graph rendering integration consuming saved graph configurations
Any deployment persisting shared graph configurations across users

Discovery Timeline

2026-08-11 - CVE-2026-73158 published to NVD
2026-08-11 - Last updated in NVD database

Technical Details for CVE-2026-73158

Vulnerability Analysis

The vulnerability resides in how cti-transmute stores and later serves graph configuration objects. Graph configurations include style entries used by the Pivotick renderer. Pivotick treats the svgIcon property as raw HTML and injects it into the DOM during graph rendering. The server accepts arbitrary style properties without a schema constraint, and the client re-applies stored values without sanitization. An authenticated attacker saves a configuration containing an svgIcon value carrying an inline event handler or <script> payload. When another user, potentially an administrator, opens the shared configuration, the browser parses the attacker-supplied HTML and executes the embedded script in the victim's origin.

Root Cause

The root cause is missing input validation on both persistence and consumption paths. Neither the Flask server-side handler in website/web/conversions/conversions.py nor the client-side renderer in website/web/static/js/graph/conversionGraph.js enforced an allow-list schema. Dangerous fields such as svgIcon and iconClass were persisted verbatim and later interpreted as HTML by Pivotick.

Attack Vector

Exploitation requires network access and a low-privileged authenticated account. The attacker saves a malicious graph configuration containing a crafted svgIcon. Victim interaction is required: another user must open or apply the configuration in Pivotick. Once rendered, the injected script executes with the victim's session context, allowing account actions, token theft, or lateral movement within the application.

python

# Patch: website/web/conversions/conversions.py
 def graph_config_list():
     configs = ConversionModel.get_graph_configs(user_id=current_user.id, is_admin=current_user.is_admin())
     is_admin = current_user.is_admin()
-    return {"success": True, "list": [c.to_json(current_user_id=current_user.id, is_admin=is_admin) for c in configs]}, 200
+    items = []
+    for c in configs:
+        item = c.to_json(current_user_id=current_user.id, is_admin=is_admin)
+        item["config_json"] = ConversionModel.sanitize_stored_graph_config(item["config_json"])
+        items.append(item)
+    return {"success": True, "list": items}, 200


 @conversions_blueprint.route("/graph_config/save", methods=["POST"])

Source: GitHub Commit 9b31758. The patch sanitizes stored configurations when listed, before they reach the browser.

javascript

// Patch: website/web/static/js/graph/conversionGraph.js
-import { escapeGraphLabels, renderRawJson, textCell } from './graphSafety.js'
+import { escapeGraphLabels, renderRawJson, sanitizeConfigPatch, textCell } from './graphSafety.js'

// ─────────────────────────────────────────────────────────────────────────────
//  GRAPH CONFIG — edit this object to change graph behaviour & appearance.

Source: GitHub Commit 9b31758. The client imports sanitizeConfigPatch to strip unsafe fields before applying stored configurations.

Detection Methods for CVE-2026-73158

Indicators of Compromise

Saved graph configuration entries containing an svgIcon or iconClass property
Configuration JSON blobs containing <script>, onerror=, onload=, or javascript: substrings
Unexpected outbound requests originating from administrator browser sessions shortly after opening a shared graph configuration

Detection Strategies

Query the graph configuration store for records whose serialized config_json includes keys outside the sanctioned allow-list (shape, color, size)
Inspect HTTP POST bodies to /graph_config/save for style entries containing HTML tags or event-handler attributes
Compare configuration authors against viewers; flag configurations authored by low-privileged users and later rendered in admin sessions

Monitoring Recommendations

Enable Content Security Policy (CSP) reporting to capture inline-script violations triggered by rendered graph payloads
Log all writes and reads to the graph configuration endpoints with user identity and payload hashes
Alert on browser console errors or DOM mutation patterns consistent with injected svgIcon HTML during Pivotick rendering

How to Mitigate CVE-2026-73158

Immediate Actions Required

Update cti-transmute to a build containing commit 9b317587fa4ec11b6f72c2d1d8b98a686537b4fb
Audit existing stored graph configurations and remove any entries containing svgIcon or iconClass fields
Rotate session tokens for administrators who may have viewed untrusted configurations

Patch Information

The upstream fix introduces a strict configuration schema enforced on both server and client. Only known properties are accepted, style entries are limited to shape, color, and size, and dangerous properties such as svgIcon and iconClass are explicitly rejected. Existing stored configurations are sanitized when listed and again before being applied in the browser. Reference: MISP/cti-transmute commit 9b31758.

Workarounds

Restrict graph configuration creation to trusted users until the patched build is deployed
Deploy a restrictive Content Security Policy that forbids inline scripts and event handlers on pages rendering Pivotick graphs
Manually purge any configuration records containing HTML-bearing style properties from the backing datastore

bash

# Example: identify configurations containing dangerous fields prior to patching
grep -Ei '"(svgIcon|iconClass)"' /path/to/cti-transmute/data/graph_configs/*.json