The vulnerability resides in cti‑transmute’s handling of tooltip formatters for ECharts Sunburst and Treemap visualizations. Values supplied by STIX or MISP data are inserted directly into the tooltip string without HTML escaping. When a malicious party supplies conversion data containing code, that code is interpreted as markup by ECharts and executed in the browser when a user hovers over the affected slice, providing a classic reflected XSS flaw (CWE‑79).

This flaw affects the cti‑transmute component of the MISP platform. All releases released before the commit linked in the advisory are vulnerable; the fix is contained in the code commit c5b024a8ef5632f8939cfe2dad9026064698f4bb which replaces the direct interpolation with escapeHtml calls on the slice name, data value, and value.

The CVSS score of 5.3 indicates moderate severity. EPSS data is not available and the flaw is not listed in the CISA KEV catalog. The attack requires that an adversary can supply or influence conversion data that is rendered by the visualization; such data might be introduced through API calls or the MISP interface. Once an attacker injects malicious payloads, any user who views the affected chart will trigger execution of the payload in their browser. Because the exploitation is client‑side, the threat is primarily to confidentiality and integrity of user session data, and possible data exfiltration or credentials theft.