XSS in Misp Cti-Transmute
CVE-2026-73156
Affected versions of cti-transmute fail to HTML-escape attacker-controlled values used in ECharts Sunburst and Treemap tooltip formatters. Slice names may originate directly from STIX or MISP data, including STIX types, relationship_type, pattern prefixes, and MISP category/type values. Since ECharts interprets the formatter return value as HTML, crafted values can inject markup or script-capable content into the tooltip. An attacker who can cause malicious conversion data to be processed can therefore inject content that executes when another user views the visualization and hovers over the affected slice. The patch replaces direct interpolation with dedicated formatter functions that call escapeHtml() on p.name, p.data.value, and p.value.
Vulnerability class: XSS (Cross-Site Scripting)
Published · last modified .
EPSS exploit prediction
EPSS: 0.004 (35.9th percentile), scored .
Very low probability of exploitation in the next 30 days; routine patching cadence is appropriate. 36th percentile — 35.9% of CVEs in the catalogue have a lower EPSS than this one. How to read EPSS.
EPSS over last 30 days · oldest: 0.003 · newest: 0.004 · change: +0.001
Affected products
- Misp Cti-Transmute — versions 0