The vulnerability arises from the safeEjs.ts file failing to sanitize EJS templates. A user with the Manage customization capability can embed arbitrary JavaScript in a notifier template, which is executed in the context of the OpenCTI platform process. This leads to remote code execution within the platform’s environment, allowing an attacker to compromise confidentiality, integrity, and availability of the system. The weakness is classified as CWE‑1336.

OpenCTI Platform (opencti) versions prior to 6.9.5 are affected. The vulnerability is fixed in 6.9.5. Attackers must have Manage customization rights on the affected installation.

The CVSS base score is 9.1, reflecting a high severity. The EPSS score is not available and the vulnerability is not listed in CISA’s KEV catalog. An attacker who gains Manage customization privileges can exploit the flaw by creating or modifying a notifier template, resulting in arbitrary code execution. Given the lack of an actively exploited variant in the wild, the likelihood of exploitation may be low, but the potential impact is severe, warranting immediate action.