A stored cross‑site scripting vulnerability exists in MISP cti‑transmute where the tag icon value is stored and later rendered using Vue's v-html. The server‑side helper directly injects the icon string into an HTML element, allowing a crafted icon value to break out of the intended markup and insert arbitrary HTML or JavaScript. This flaw, identified as CWE‑79, permits an attacker to execute scripts inside the browser context of any user who views the administrative triage interface.

The issue affects all versions of MISP cti‑transmute that accept user‑supplied icon values for tags. Specific version ranges are not listed, so any active deployment prior to the commit that addresses the icon validation and rendering logic is potentially vulnerable. The flaw resides in the client‑side rendering of the tag icon in the admin triage page.

The CVSS score of 5.1 indicates a medium‑severity vulnerability. No EPSS score is published, and the vulnerability is not listed in CISA KEV, suggesting no known active exploits. The exploit requires an attacker to insert a malicious icon value when creating or editing a tag and then have an administrator or other privileged user view the affected tag in the triage interface. Successful exploitation would allow the attacker to run arbitrary scripts in the browser, potentially leading to credential theft or session hijack.