A flaw in the search highlight feature of cti‑transmute causes the highlight() function to return raw conversion‑table text or to wrap matched text in <mark> tags without escaping the content. Malicious markup embedded within conversion‑table values can therefore be rendered as HTML, enabling a cross‑site scripting attack. The vulnerability is a typical case of unescaped output (CWE-116) that results in cross‑site scripting (CWE-79). The primary impact is the ability of an attacker to inject and execute arbitrary script in the browser of any user who views pages that render the converted content.

The affected product is MISP:cti‑transmute. No specific version ranges are provided in the advisory, so any version of cti‑transmute that includes the unescaped highlight logic is considered at risk.

The CVSS score of 5.1 indicates a moderate severity. EPSS is not available and the vulnerability is not listed in the CISA KEV catalog. Exploitation requires the attacker to create or modify conversion‑table entries containing special characters; if the application allows untrusted users to add such data, an attacker can trigger the flaw via normal usage. In environments where only trusted users can write to the conversion table, the exploit window narrows to privilege‑escalation or insider threat. Overall, the risk is moderate pending the existence of write access to the conversion table.