CVE-2026-72751: CTI-Transmute: stored XSS in graph UI via Pivotick

CTI-Transmute is affected by a stored cross-site scripting (XSS) vulnerability in the conversion graph used to visualise converted MISP and STIX content. Attacker-controlled values originating from converted CTI data were passed to multiple HTML-parsing sinks in the graph user interface without sufficient neutralisation. In particular, node labels, node sublabels, edge labels, node properties, edge properties, and node types could contain crafted HTML or JavaScript content. The Pivotick graph library renders some of these values through HTML-parsing operations. Consequently, a malicious value such as an HTML element containing an event handler could be interpreted as markup rather than displayed as plain text. The first remediation explicitly notes that Pivotick rendered node and edge labels as HTML and therefore introduced escaping before data was handed to the graph renderer. A separate vulnerable sink was present in the Open raw JSON functionality. The raw object associated with a graph node was inserted into a new document using document.write() and an interpolated HTML string. Crafted JSON content could therefore break out of the intended <pre> element and inject executable markup. The fix replaced this construction with DOM APIs and assigns the JSON using textContent. The initial correction did not cover all Pivotick rendering paths. A subsequent patch addressed additional XSS vectors in the graph properties panel. Values derived from the original CTI object—including property names, property values, hash algorithm names, child attributes, edge properties, and STIX object types—could still reach Pivotick's HTML resolver. According to the patch, Pivotick's tryResolveHTMLElement processes string values using template.innerHTML, allowing malicious markup to execute when a graph node is hovered over or selected. The complete remediation therefore: * HTML-escapes node labels, node sublabels, and edge labels before they are passed to Pivotick. * Restricts graph node type values to a safe identifier character set. * Wraps node and edge property values in DOM elements populated through textContent, preventing Pivotick from treating attacker-controlled strings as HTML. * Replaces the raw-JSON popup's interpolated document.write() with DOM construction and textContent.

An adversary crafts a MISP event or STIX bundle containing an indicator whose node label, property value, or type field embeds an HTML element with an event handler (e.g., an <img onerror=...> payload) and gets it ingested into a shared MISP community feed or a feed the target organization consumes. When a SOC/CTI analyst later opens CTI-Transmute to visualise the converted graph and hovers over, selects, or opens the raw JSON for that node, Pivotick's tryResolveHTMLElement (or the legacy document.write() raw-JSON path) renders the payload as markup instead of text, executing attacker JavaScript in the analyst's authenticated browser session — enabling session/cookie theft, further pivoting into internal tooling reachable from that session, or manipulation of the CTI platform's data.