A stored cross‑site scripting vulnerability allows an attacker to inject arbitrary JavaScript into notification messages that reference user‑controlled convert names. The injected code is rendered via innerHTML in the notification bell dropdown and executes in the browser of any authenticated user who opens the panel. Successful exploitation could enable the attacker to perform actions within the victim’s session or read client‑side application data, directly affecting confidentiality and integrity of the user’s workspace.

CTI Transmute, a component of the MISP platform. The vulnerability exists in all builds before the patched release and was only present on a development branch.

The CVSS score of 6.3 indicates moderate severity. No EPSS score is published and the vulnerability is not listed in CISA KEV. The attack requires an authenticated web session accessing the notification panel and likely occurs on the development branch, so internal or compromised user credentials are prerequisites. Because the flaw is client‑side, it can be exploited by attackers who can influence convert names associated with notifications.