CVE-2026-73156 MISP CVE debrief

Who should care

Users of cti-transmute, especially those processing STIX or MISP data, should be aware of this vulnerability and take action. This includes operators of cti-transmute, security teams, and vulnerability management teams who need to assess the impact and prioritize patching. Additionally, defenders responsible for monitoring and incident response should be aware of potential indicators of exploitation.

Technical summary

cti-transmute fails to HTML-escape attacker-controlled values in ECharts Sunburst and Treemap tooltip formatters, allowing XSS. The vulnerability arises from direct interpolation of STIX or MISP data into ECharts formatters without proper escaping. This can lead to injection of markup or script-capable content into tooltips when users hover over affected slices. The patch replaces direct interpolation with dedicated formatter functions that call escapeHtml() on p.name, p.data.value, and p.value. An attacker who can cause malicious conversion data to be processed can therefore inject content that executes when another user views the visualization and hovers over the affected slice.

Defensive priority

Defenders should prioritize patching cti-transmute to prevent potential XSS attacks through malicious STIX or MISP data.

Recommended defensive actions

• Patch cti-transmute to latest version
• Review and sanitize STIX and MISP data
• Implement additional XSS protections
• Review compensating controls for exposed systems
• Check relevant monitoring, detection, and logs for exposed assets
• Track exceptions and retest remediated assets
• Confirm whether affected product deployments exist in managed environments

Evidence notes

Evidence is limited; primary official records indicate cti-transmute vulnerability allows XSS via ECharts tooltips. Further verification needed. Additional review of STIX or MISP data processing and potential impact on cti-transmute users is required. Defenders should verify patch deployment and review STIX/MISP data handling.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.