CVE-2026-73159: cti-transmute XSS Vulnerability

CVE-2026-73159 Overview

CVE-2026-73159 is a stored Cross-Site Scripting (XSS) vulnerability [CWE-79] in cti-transmute, a component of the MISP (Malware Information Sharing Platform) ecosystem. The flaw resides in the mapIcon() helper, which interpolated a user-supplied tag icon value directly into an HTML string rendered through Vue's v-html directive. An authenticated user with permission to create or modify tags can supply a crafted icon value that breaks out of the intended <i> element and injects attacker-controlled markup. The payload executes when the tag is rendered in any viewer's browser, including on the administrative triage interface.

Critical Impact
Attackers with low-privilege access can store JavaScript payloads that execute in the browsers of other users, including administrators reviewing tagged threat intelligence.

Affected Products

MISP cti-transmute (versions prior to the fix committed in cc13416)
Administrative triage interface rendering tag icons
Any Vue component using the vulnerable mapIcon() helper with v-html

Discovery Timeline

2026-08-11 - CVE CVE-2026-73159 published to NVD
2026-08-11 - Last updated in NVD database

Technical Details for CVE-2026-73159

Vulnerability Analysis

The vulnerability is a stored XSS caused by unsafe HTML interpolation of a persisted user-controlled field. The mapIcon() helper in cti-transmute previously returned a raw HTML fragment of the form <i class="fas fa-${name}"></i>, where name was taken directly from the stored tag's icon attribute. The returned string was then bound to a DOM node using Vue's v-html directive, which parses and inserts the value as live HTML.

Because no sanitization or allowlisting was performed on the icon value before storage or rendering, a crafted value could terminate the class attribute and inject arbitrary tags, attributes, or event handlers. When the affected tag was rendered on any page consuming the component, including the admin triage view, the injected payload executed with the privileges of the viewing session.

Root Cause

The root cause is direct string concatenation of untrusted input into an HTML template, combined with the use of v-html for rendering. Vue's v-html bypasses the framework's default text-escaping, making it the developer's responsibility to guarantee the content is safe. The backend also lacked validation on the icon field at storage time, allowing arbitrary strings to persist in the tag store.

Attack Vector

Exploitation requires an authenticated user who can create or edit a tag. The attacker sets the tag's icon value to a payload that escapes the intended fa-${name} context. Once another user, such as an analyst or administrator, loads a page that renders the tag through mapIcon(), the payload executes in that user's browser. User interaction (viewing the page containing the tag) is required.

javascript

// Vulnerable pattern (before patch)
<span class="tag-left" v-html="mapIcon(tag.icon)"></span>

// Patched pattern - icon value is bound as a CSS class, not HTML
<span class="tag-left"><i :class="mapIcon(tag.icon)"></i></span>

Source: GitHub Commit cc13416

Detection Methods for CVE-2026-73159

Indicators of Compromise

Tag records with icon values that do not match the FontAwesome catalogue or a [a-z0-9-]{1,40} slug pattern.
Tag icon fields containing HTML metacharacters such as <, >, ", ', or =.
Presence of substrings like onerror, onload, <script, or javascript: inside any tag icon value.

Detection Strategies

Query the tag database for any icon values longer than 40 characters or containing non-slug characters.
Review browser Content Security Policy (CSP) violation reports for inline script execution originating from tag rendering views.
Audit web server logs for POST and PUT requests to tag creation and edit endpoints containing suspicious icon payloads.

Monitoring Recommendations

Enable CSP reporting on the administrative triage interface to surface unexpected inline script execution.
Log and alert on tag mutation events, capturing the submitting user and the raw icon value for later review.
Correlate anomalous session activity (unexpected privileged actions) with recent tag modifications by the same or a preceding user.

How to Mitigate CVE-2026-73159

Immediate Actions Required

Update cti-transmute to the version that includes commit cc13416d606d91d543ce1f1e41387750f8450153.
Audit all existing tag records and remove or normalize any icon value that does not conform to the FontAwesome slug pattern.
Restrict tag creation and edit permissions to trusted users until the patch is applied.

Patch Information

The fix mitigates the issue at multiple layers. First, v-html is replaced with Vue's :class binding, ensuring the value is treated as a class name rather than HTML. Second, mapIcon() now returns only a constrained FontAwesome class string. Third, the backend validates icons against the FontAwesome catalogue or a strict [a-z0-9-]{1,40} slug pattern before storing them. See GitHub Commit cc13416 for the full diff.

Workarounds

Deploy a strict Content Security Policy that disallows inline script execution on pages that render tags.
Add a reverse-proxy or application-layer filter that rejects tag write requests containing non-slug characters in the icon field.
Temporarily disable rendering of tag icons in the UI by overriding the affected Vue components to render a static placeholder.

bash

# Example: validate icon values match the patched slug pattern before insert
grep -E -v '^[a-z0-9-]{1,40}$' tag_icons.txt > invalid_icons.txt