CyberRota Analysis
AI-GeneratedThe cti-transmute application is vulnerable to HTML injection due to improper handling of data from remote MISP instances, allowing a malicious server to inject harmful HTML or script content into the event-browser interface. This could lead to potential cross-site scripting (XSS) attacks, compromising the integrity of the application and user data. Organizations using cti-transmute should prioritize patching this vulnerability to safeguard against potential exploitation, particularly those relying on remote MISP instances for data.
Public Exploit Signal
A public exploit, PoC, GitHub repository or Metasploit reference was detected for this CVE.
Note: these links are listed for security research and verification purposes only.
Original NVD Description
Affected versions of cti-transmute render data obtained from a remote MISP instance into the event-browser interface using HTML interpolation. Because fields such as event IDs, event information, organization names, tags, tag colors, TLP labels, distribution labels, and error/flash text may be controlled by the remote MISP server, a malicious or compromised remote instance could return crafted values that inject HTML or script-capable content into the cti-transmute interface. The patch explicitly notes that remote-derived values must not reach innerHTML, and replaces string-built rows and badges with DOM nodes populated through textContent. It also restricts remote-controlled tag colors to six-digit hexadecimal values, preventing malicious CSS values such as url(...).