CTI‑Transmute is affected by a stored cross‑site scripting flaw in its conversion graph that visualises converted MISP and STIX content. Attacker‑controlled values originating from converted CTI data were passed to several HTML‑parsing sinks in the graph user interface without sufficient neutralisation. Node labels, sublabels, edge labels, node and edge properties, and node types could contain crafted HTML or JavaScript that would be interpreted by the Pivotick graph library or by a document.write() operation used for raw JSON pop‑ups. A malicious user could therefore embed arbitrary script into the graph. The result is client‑side code execution in the context of any user who views the affected graph, potentially enabling cookie theft, session hijacking, content defacement or further internal actions.

The vulnerability affects the MISP CTI‑Transmute component, which is used to convert and display CTI data. All releases that have not yet applied the patch that introduces HTML escaping for graph labels and removes raw JSON document.write() should be considered vulnerable. Specific version information was not disclosed in the entry, but the fixes are included in the commits referenced in the advisories.

The CVSS score of 5.1 indicates moderate severity. EPSS data is not available, and the vulnerability is not listed in CISA’s KEV catalogue. Exploitation requires the ability to inject or modify CTI data that is converted into the graph; once an attacker supplies malicious content, any user who opens the graph will execute the injected script. While the vector is not automatically exploitable by the public internet, it poses a significant risk in environments where CTI ingestion is open to untrusted parties or where users have broad permissions to interact with the graph UI.