CVE-2026-73161: cti-transmute XSS Vulnerability

CVE-2026-73161 Overview

CVE-2026-73161 is a stored Cross-Site Scripting (XSS) vulnerability [CWE-79] in cti-transmute, a MISP-affiliated web utility for converting cyber threat intelligence data. The highlight() function in the conversion-table search feature returned raw text when no query was supplied, or performed a regex-based <mark> insertion without first escaping the source content. Because the resulting string is rendered through an HTML sink such as Vue's v-html, attacker-controlled markup inside conversion data is executed as HTML in the analyst's browser.

Critical Impact
An authenticated user who can influence conversion-table data can inject arbitrary HTML or JavaScript that executes in the context of other users viewing the affected table.

Affected Products

MISP cti-transmute web component (website/web/static/js/graph/conversionTable.js)
Deployments rendering conversion-table cells via HTML sinks prior to commit ac49564
Any downstream tooling embedding the unpatched highlight() helper

Discovery Timeline

2026-08-11 - CVE-2026-73161 published to NVD
2026-08-11 - Last updated in NVD database

Technical Details for CVE-2026-73161

Vulnerability Analysis

The vulnerability resides in the search-highlight code path used by the conversion-table UI in cti-transmute. The original highlight() function had two unsafe branches. When no search query was provided, it returned the underlying cell text unchanged. When a query was provided, it executed a String.replace() that wrapped matches in <mark> tags without first neutralizing HTML metacharacters in the surrounding text.

The rendered output is consumed by an HTML-rendering sink, so any <, >, &, or quote characters present in conversion data are parsed as markup. An attacker who controls one or more conversion-table field values, for example through crafted CTI records ingested into MISP, can plant <script> or event-handler payloads that execute when an analyst views or searches the table.

Root Cause

The root cause is missing output encoding before insertion into an HTML sink. The prior implementation trusted conversion-table content and treated the <mark> wrapper as the only markup, ignoring that the wrapped text itself was never HTML-escaped.

Attack Vector

Exploitation requires an authenticated user with the ability to influence data appearing in the conversion table and a victim who loads that view. Interaction is limited to normal use of the search-highlight feature, or simply rendering the table when the unsafe no-query branch is hit.

javascript

// Patch: website/web/static/js/graph/searchHighlight.js
// Source: https://github.com/MISP/cti-transmute/commit/ac495641ef3ca927676a73ba8f1bcdfd952413df

export function escapeHtml(str) {
    return String(str)
        .replace(/&/g, '&')
        .replace(/</g, '<')
        .replace(/>/g, '>')
        .replace(/"/g, '"')
}

// The query is escaped the same way as the text so HTML specials in the
// query line up with the entities they became in the escaped text.
export function highlightMatches(text, query) {
    const escaped = escapeHtml(text)
    if (!query) return escaped
    const q = escapeHtml(query).replace(/[.*+?^${}()|[\]\\]/g, '\\$&')
    return escaped.replace(new RegExp(`(${q})`, 'gi'), '<mark class="ctbl-mark">$1</mark>')
}

The fix introduces a shared highlightMatches() helper that escapes special characters before inserting the application-controlled <mark> element, ensuring the wrapper is the only markup that survives.

Detection Methods for CVE-2026-73161

Indicators of Compromise

Conversion-table fields containing HTML control characters such as <script>, onerror=, onload=, or <img tag fragments.
Browser console errors or unexpected network requests originating from the conversion-table view.
Ingested CTI records where free-text fields contain raw HTML or JavaScript payloads instead of expected values.

Detection Strategies

Review server-side logs for conversion-table renderings that coincide with anomalous outbound requests from analyst browsers.
Perform code-level auditing for any remaining uses of the legacy highlight() function that bypasses escapeHtml().
Scan stored conversion-table data at rest for raw HTML markup indicative of injection attempts.

Monitoring Recommendations

Enable Content Security Policy (CSP) reporting on the cti-transmute web UI and alert on script-src violations.
Monitor authenticated user sessions for atypical data submissions containing HTML metacharacters in CTI fields.
Track deployments to confirm they include the patched searchHighlight.js helper.

How to Mitigate CVE-2026-73161

Immediate Actions Required

Update cti-transmute to a revision that includes commit ac495641ef3ca927676a73ba8f1bcdfd952413df.
Audit stored conversion-table data for previously injected HTML payloads and sanitize as needed.
Restrict which authenticated roles can submit or import data that populates conversion tables.

Patch Information

The upstream fix is available in the MISP cti-transmute repository. See GitHub Commit ac495641 for the change that introduces the highlightMatches() helper in website/web/static/js/graph/searchHighlight.js and refactors conversionTable.js to import it.

Workarounds

Disable or hide the conversion-table search-highlight view until the patch is deployed.
Apply a strict CSP that forbids inline scripts and event handlers on the cti-transmute origin.
Pre-sanitize CTI ingestion pipelines to strip HTML metacharacters from fields that surface in conversion tables.

bash

# Apply the upstream patch
git fetch origin
git checkout ac495641ef3ca927676a73ba8f1bcdfd952413df -- \
    website/web/static/js/graph/searchHighlight.js \
    website/web/static/js/graph/conversionTable.js

# Verify the helper is imported
grep -n "highlightMatches" website/web/static/js/graph/conversionTable.js