CTI‑Transmute suffers from a stored cross‑site scripting flaw that occurs when the application accepts user‑controlled data containing Vue template delimiters and subsequently renders it with the Vue runtime compiler. Because the data is stored and later injected into a DOM element that is compiled by Vue, an attacker can supply a malicious expression that evaluates to JavaScript, enabling arbitrary code execution in the victim’s browser context. The implications of this include theft of confidential information exposed on the page, hijacking of the victim’s session to perform authenticated actions, and the ability to modify or delete application data. The vulnerability is classified under CWE‑1336 and CWE‑79, reflecting improper neutralization of template expressions and XSS weaknesses.

The affected product is CTI‑Transmute, as identified by the CNA misp:cti-transmute. No specific version information is supplied in the CNA data; therefore, the risk assessment applies to all deployments of CTI‑Transmute that have not yet applied the vendor’s fix. Users of older or unsupported releases should treat this as an active threat until a patch is available.

The CVSS score of 5.1 indicates a moderate impact, primarily driven by the ability to execute arbitrary JavaScript in the user’s session. The EPSS score is not available, and the vulnerability is not listed in the CISA KEV catalog, suggesting no widespread exploitation has been observed to date. The attack vector is inferred to be unauthenticated, relying on the creation of a public conversion or the injection of malicious content into user profile names. Because the malicious payload is stored, any user who views the affected page—including administrators—can be impacted, thereby elevating the potential for privilege escalation.