A flaw in cti‑transmute causes HTML interpolation of data supplied by a remote MISP instance to be rendered directly in the event‑browser interface. Fields such as event IDs, organization names, tags, colors, and export text can be controlled by the remote MISP server; a malicious attacker or a compromised remote instance could therefore inject arbitrary HTML or script content. The vulnerability permits typical cross‑site scripting attacks, which could lead to session hijacking, data theft, or defacement of the interface by manipulating the victim’s browser. The weakness is described by CWE‑116 (Improper Encoding or Escaping of Output) and CWE‑79 (Cross‑Site Scripting).

The vulnerability affects the cti‑transmute component of MISP. No specific product versions are listed, so all current installations of cti‑transmute are potentially vulnerable until a newer release adopts the mitigation. The patch replaces string‑built rows and badges with securely created DOM nodes and restricts tag colors to valid six‑digit hexadecimal values to stop malicious CSS such as url(...) being used.

The CVSS score of 2.3 indicates a low severity impact. The EPSS score is not available, and the vulnerability is not in the CISA KEV catalog, suggesting a low likelihood of exploitation in the wild. The attack vector is remote; an attacker would need control over a remote MISP instance that cti‑transmute queries. No privileged or local access is required, but if an attacker can make cti‑transmute request data from a maliciously configured MISP server, XSS can be achieved in the cti‑transmute web UI. The patch eliminates the risk by ensuring remote‑derived values never reach innerHTML and by validating tag colors.