CVE-2026-73157cti-transmute Remote MISP Event Browser Allows Cross-Site Scripting via Malicious Event Metadata

Affected versions of cti-transmute render data obtained from a remote MISP instance into the event-browser interface using HTML interpolation. Because fields such as event IDs, event information, organization names, tags, tag colors, TLP labels, distribution labels, and error/flash text may be controlled by the remote MISP server, a malicious or compromised remote instance could return crafted values that inject HTML or script-capable content into the cti-transmute interface. The patch explicitly notes that remote-derived values must not reach innerHTML, and replaces string-built rows and badges with DOM nodes populated through textContent. It also restricts remote-controlled tag colors to six-digit hexadecimal values, preventing malicious CSS values such as url(...).

CVSS

2.3 LOW (v4.0, CNA)CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:P/VC:L/VI:L/VA:N/SC:L/SI:L/SA:N

Weakness (CWE)

CWE-79, CWE-116

Known exploited

Not in CISA's KEV catalog

EPSS (exploitation in the next 30 days)

Not loaded for this CVE

Assigned by

CIRCL

NVD analysis

Deferred

Record last updated

Aug 11, 2026

First seen by InfoSec Signals

Oct 9, 2026

The CVE record on cve.org · NVD's entry

The CVE record is authoritative. Products marked “from the name” were identified from the CNA's free-text names, not a CPE, and are matched less certainly. This product uses the NVD API but is not endorsed or certified by the NVD.