CyberRota Analysis
AI-GeneratedThe vulnerability arises in the cti-transmute library, where improper handling of conversion-table values in the search highlighting feature allows for unescaped HTML content to be rendered, potentially leading to cross-site scripting (XSS) attacks. This flaw affects any applications utilizing the library for search functionality, making it critical for developers and security teams to prioritize patching to mitigate the risk of malicious markup exploitation. Organizations relying on cti-transmute for text processing should assess their exposure and implement the recommended fixes promptly.
Public Exploit Signal
A public exploit, PoC, GitHub repository or Metasploit reference was detected for this CVE.
Note: these links are listed for security research and verification purposes only.
Original NVD Description
Affected versions of cti-transmute improperly handle conversion-table values passed through the search highlighting feature. The highlight() function previously returned the underlying text directly when no search query was supplied, or performed a regex replacement that inserted <mark> tags without first escaping the original content. Because the resulting value is used by an HTML-rendering sink, malicious markup contained in conversion data could be interpreted as HTML rather than displayed as text. The fix introduces a shared highlightMatches() helper that first converts special characters such as <, >, &, and quotes into HTML entities. Only after escaping does the code insert the application-controlled <mark> element used for search highlighting.