CVE-2026-73158 cti-transmute Saved Graph Configuration Allows Stored Cross-Site Scripting via svgIcon
A stored XSS vulnerability in cti-transmute allows attackers to execute scripts in other users' browsers via malicious graph configurations.
- Exploited in the wild
- Not known
- Login needed
- Any signed-in user
- Attackable
- Over the internet
- Victim action needed
- A user has to click or open something
- Fix
- None listed
What is CVE-2026-73158?
CVE-2026-73158 is a medium-severity cross-site scripting vulnerability in MISP cti-transmute, published on 11 Aug 2026. Any signed-in user can exploit it over the network, and only if a user opens a file or follows a link.
Official description
Affected versions of cti-transmute insufficiently validate saved graph configuration data. Graph configurations can contain style properties that are later consumed by Pivotick, and Pivotick interprets svgIcon as HTML. Because saved configurations may be created by one user and later displayed to other users—including administrators—a malicious user could store a crafted svgIcon value that executes script in another viewer’s browser.
The fix introduces a strict configuration schema on both the server and client. Only known properties are accepted, style entries are limited to shape, color, and size, and dangerous properties such as svgIcon and iconClass are explicitly rejected. Existing stored configurations are also sanitized when listed and again before being applied in the browser.
Which versions are affected by CVE-2026-73158?
How do I fix CVE-2026-73158?
No fix has been published for CVE-2026-73158 yet. Limit exposure of the affected software until one is available.
Escape output for the context it lands in and set a strict Content Security Policy. Upgrading the affected component is the real fix. More about Cross-site scripting.
Is CVE-2026-73158 being exploited?
There is no known exploitation of CVE-2026-73158 in the wild and no public exploit code.
Sources
Also known as GHSA-j8cv-pjx7-pvqf.