CVE-2026-9806: CTI Transmute Stored XSS Vulnerability

CVE-2026-9806 Overview

CVE-2026-9806 is a stored cross-site scripting (XSS) vulnerability in the notification panel of CTI Transmute, a tool in the MISP ecosystem. The notification bell dropdown rendered messages containing user-controlled convert names through innerHTML without adequate sanitization. An attacker who can create or influence a convert name included in a notification can inject arbitrary JavaScript. The payload executes in the browser of any authenticated user who opens the notification panel. The maintainers confirm this vulnerability was only present on a development branch, limiting real-world exposure. The flaw is classified under CWE-79.

Critical Impact
Successful exploitation allows attackers to execute JavaScript in an authenticated user's session, perform actions on their behalf, and access information available to the application in the browser context.

Affected Products

CTI Transmute (MISP project) development branch prior to commit cf42409
Deployments running unpatched development builds of the notification panel component
Authenticated users interacting with the notification bell dropdown

Discovery Timeline

2026-05-28 - CVE-2026-9806 published to NVD
2026-05-28 - Last updated in NVD database

Technical Details for CVE-2026-9806

Vulnerability Analysis

The vulnerability resides in the client-side rendering logic of the CTI Transmute notification bell dropdown. Notification messages embed user-controlled convert name values directly into the DOM through the innerHTML property. Because innerHTML parses assigned strings as HTML, any markup or <script>-equivalent constructs in the convert name are interpreted by the browser.

An attacker creates or influences a convert with a malicious name containing JavaScript payloads. When the application generates a notification referencing that convert, the script becomes part of the notification HTML. Any authenticated user opening the notification panel triggers execution under the application's origin. The attacker inherits the victim's session context, enabling actions on behalf of the user and access to in-browser data.

Root Cause

The root cause is improper neutralization of input during web page generation [CWE-79]. The notification rendering code concatenated dynamic, user-influenced strings into HTML and assigned the result to innerHTML, bypassing the browser's text-only interpretation path. No output encoding or sanitization layer separated the trusted template from the untrusted convert name field.

Attack Vector

The attack vector is network-based and requires no authentication on the attacker side beyond the ability to influence a convert name. Exploitation is passive from the victim's perspective: the authenticated user only needs to open the notification panel. The fix replaces the unsafe pattern by constructing notification elements through DOM methods such as document.createElement and assigning user-controlled message content via textContent instead of innerHTML. Refer to the GitHub commit for the remediation diff.

Detection Methods for CVE-2026-9806

Indicators of Compromise

Convert names containing HTML tags, event handlers (onerror=, onload=), or javascript: URI schemes stored in CTI Transmute data
Unexpected outbound HTTP requests originating from authenticated user sessions immediately after opening the notification panel
Notification records whose message fields include markup characters such as <, >, or &#

Detection Strategies

Inspect persisted notification and convert records for HTML or script syntax in name fields
Review browser Content Security Policy (CSP) violation reports for inline script execution in the notification panel context
Audit web server access logs for anomalous API calls following notification panel views by privileged accounts

Monitoring Recommendations

Enable CSP reporting endpoints to capture inline script violations during notification rendering
Track session activity correlated with notification panel access to identify scripted actions performed without explicit user input
Monitor commits and deployment pipelines to confirm production environments do not pull from the affected development branch

How to Mitigate CVE-2026-9806

Immediate Actions Required

Update CTI Transmute to a build that includes commit cf42409badc27b13d9bb644b9175aa7f27e11259 or later
Avoid deploying the affected development branch to any environment accessible by authenticated users
Sanitize or invalidate existing convert names containing HTML markup before exposing them in notifications

Patch Information

The maintainers remediated the issue by rewriting the notification rendering logic. Notification elements are now constructed with DOM methods, and message content is assigned through textContent instead of innerHTML. Full details are available in the MISP CTI Transmute commit.

Workarounds

Restrict convert creation and naming permissions to trusted users until the patch is applied
Deploy a strict Content Security Policy that disallows unsafe-inline script execution on pages rendering notifications
Temporarily disable the notification bell dropdown in affected deployments

bash

# Example Content-Security-Policy header to block inline script execution
add_header Content-Security-Policy "default-src 'self'; script-src 'self'; object-src 'none'; base-uri 'self'";