CVE-2026-72751

CTI-Transmute is affected by a stored cross-site scripting (XSS) vulnerability in the conversion graph used to visualise converted MISP and STIX content. Attacker-controlled values originating from converted CTI data were passed to multiple HTML-parsing sinks in the graph user interface without sufficient neutralisation. In particular, node labels, node sublabels, edge labels, node properties, edge properties, and node types could contain crafted HTML or JavaScript content. The Pivotick graph library renders some of these values through HTML-parsing operations. Consequently, a malicious value such as an HTML element containing an event handler could be interpreted as markup rather than displayed as plain text. The first remediation explicitly notes that Pivotick rendered node and edge labels as HTML and therefore introduced escaping before data was handed to the graph renderer. A separate vulnerable sink was present in the Open raw JSON functionality. The raw object associated with a graph node was inserted into a new document using document.write() and an interpolated HTML string. Crafted JSON content could therefore break out of the intended <pre> element and inject executable markup. The fix replaced this construction with DOM APIs and assigns the JSON using textContent. The initial correction did not cover all Pivotick rendering paths. A subsequent patch addressed additional XSS vectors in the graph properties panel. Values derived from the original CTI object—including property names, property values, hash algorithm names, child attributes, edge properties, and STIX object types—could still reach Pivotick's HTML resolver. According to the patch, Pivotick's tryResolveHTMLElement processes string values using template.innerHTML, allowing malicious markup to execute when a graph node is hovered over or selected. The complete remediation therefore: * HTML-escapes node labels, node sublabels, and edge labels before they are passed to Pivotick. * Restricts graph node type values to a safe identifier character set. * Wraps node and edge property values in DOM elements populated through textContent, preventing Pivotick from treating attacker-controlled strings as HTML. * Replaces the raw-JSON popup's interpolated document.write() with DOM construction and textContent.

• CWE-79

• https://github.com/MISP/cti-transmute/commit/b50451a746c9959efa508aeaa4a822d122687e35
• https://github.com/MISP/cti-transmute/commit/d34ccac5d82a642389390187fb3455112cbce886

Published

Aug 10, 2026

Last Modified

Aug 10, 2026

Status

Received

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2026-72745FreeRDP before 3.30.0 contains an out-of-bounds vulnerabilit…7.5
• CVE-2026-72746FreeRDP before 3.30.0 contains a server-side authentication …8.7
• CVE-2026-72747AVideo fails to sanitize the phone field during user registr…7.2
• CVE-2026-72748AVideo contains an unauthenticated arbitrary file write vuln…9.1
• CVE-2026-72749n8n before 1.123.67, 2.31.5, and 2.32.1 contains a prototype…7.1
• CVE-2026-72750n8n before 1.123.67, 2.31.5, and 2.32.1 contains a SQL injec…5.3
• CVE-2026-72759In affected versions of MISP cti-transmute, the conversion-h…6.9
• CVE-2026-72760Affected versions of MISP cti-transmute disclose users' emai…5.3
• CVE-2026-72761The webhook URL validator in `website/notifications/webhooks…6.9
• CVE-2026-72762n8n versions before 1.123.67, 2.31.5, and 2.32.1 contain an …7.7
• CVE-2026-72763n8n before 1.123.67, 2.31.5, and 2.32.1 validates credential…7.2
• CVE-2026-72764n8n's JavaScript task runner shared a single module cache ac…5.8