A vulnerability of Cross-Site Scripting was discovered in the OpenCTI Platform. The body of an email-message observable is rendered without sanitization, allowing an attacker to embed malicious script code. This flaw requires a user to view the observable, but the attack vector can be constructed through a shared STIX bundle or an ingester that processes email data. Exploitation may execute scripts in the victim's browser, enabling cross-site request forgery and eventually stealing their session.

The OpenCTI Platform, versions prior to 7.260227.0, is affected. The maintainers released 7.260227.0 which includes the fix. The vulnerability is present in any deployment that renders the raw email body in the UI.

The CVSS score of 5.3 corresponds to a moderate severity. The EPSS score is not provided and the issue is not listed in the CISA KEV catalog. The attack requires the victim to interact with a crafted email observable, typically delivered via a shared STIX bundle or an ingester, so the threat surface is limited to users who have direct access to the OpenCTI web interface. However, successful exploitation permits session hijacking and can lead to credential theft for the affected account.