{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-72751",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-08-10T17:54:12.313929Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-08-10T17:54:24.703Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "cti-transmute",
          "repo": "https://github.com/MISP/cti-transmute",
          "vendor": "misp",
          "versions": [
            {
              "lessThanOrEqual": "1.4.0",
              "status": "affected",
              "version": "0",
              "versionType": "semver"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "finder",
          "value": "Jeroen Pinoy"
        },
        {
          "lang": "en",
          "type": "remediation developer",
          "value": "Christian Studer"
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "supportingMedia": [
            {
              "base64": false,
              "type": "text/html",
              "value": "\u003cp\u003eCTI-Transmute is affected by a stored cross-site scripting (XSS) vulnerability in the conversion graph used to visualise converted MISP and STIX content.\u003c/p\u003e\u003cp\u003eAttacker-controlled values originating from converted CTI data were passed to multiple HTML-parsing sinks in the graph user interface without sufficient neutralisation. In particular, node labels, node sublabels, edge labels, node properties, edge properties, and node types could contain crafted HTML or JavaScript content.\u003c/p\u003e\u003cp\u003eThe Pivotick graph library renders some of these values through HTML-parsing operations. Consequently, a malicious value such as an HTML element containing an event handler could be interpreted as markup rather than displayed as plain text. The first remediation explicitly notes that Pivotick rendered node and edge labels as HTML and therefore introduced escaping before data was handed to the graph renderer.\u003c/p\u003e\u003cp\u003eA separate vulnerable sink was present in the \u003cstrong\u003eOpen raw JSON\u003c/strong\u003e functionality. The raw object associated with a graph node was inserted into a new document using \u003ccode\u003edocument.write()\u003c/code\u003e and an interpolated HTML string. Crafted JSON content could therefore break out of the intended \u003ccode\u003e\u0026lt;pre\u0026gt;\u003c/code\u003e element and inject executable markup. The fix replaced this construction with DOM APIs and assigns the JSON using \u003ccode\u003etextContent\u003c/code\u003e.\u003c/p\u003e\u003cp\u003eThe initial correction did not cover all Pivotick rendering paths. A subsequent patch addressed additional XSS vectors in the graph properties panel. Values derived from the original CTI object\u2014including property names, property values, hash algorithm names, child attributes, edge properties, and STIX object types\u2014could still reach Pivotick\u0027s HTML resolver. According to the patch, Pivotick\u0027s \u003ccode\u003etryResolveHTMLElement\u003c/code\u003e processes string values using \u003ccode\u003etemplate.innerHTML\u003c/code\u003e, allowing malicious markup to execute when a graph node is hovered over or selected.\u003c/p\u003e\u003cp\u003eThe complete remediation therefore:\u003c/p\u003e\u003cul\u003e\u003cli\u003eHTML-escapes node labels, node sublabels, and edge labels before they are passed to Pivotick.\u003c/li\u003e\u003cli\u003eRestricts graph node \u003ccode\u003etype\u003c/code\u003e values to a safe identifier character set.\u003c/li\u003e\u003cli\u003eWraps node and edge property values in DOM elements populated through \u003ccode\u003etextContent\u003c/code\u003e, preventing Pivotick from treating attacker-controlled strings as HTML.\u003c/li\u003e\u003cli\u003eReplaces the raw-JSON popup\u0027s interpolated \u003ccode\u003edocument.write()\u003c/code\u003e with DOM construction and \u003ccode\u003etextContent\u003c/code\u003e.\u003c/li\u003e\u003c/ul\u003e\u003cp\u003e\u003c/p\u003e"
            }
          ],
          "value": "CTI-Transmute is affected by a stored cross-site scripting (XSS) vulnerability in the conversion graph used to visualise converted MISP and STIX content.\n\nAttacker-controlled values originating from converted CTI data were passed to multiple HTML-parsing sinks in the graph user interface without sufficient neutralisation. In particular, node labels, node sublabels, edge labels, node properties, edge properties, and node types could contain crafted HTML or JavaScript content.\n\nThe Pivotick graph library renders some of these values through HTML-parsing operations. Consequently, a malicious value such as an HTML element containing an event handler could be interpreted as markup rather than displayed as plain text. The first remediation explicitly notes that Pivotick rendered node and edge labels as HTML and therefore introduced escaping before data was handed to the graph renderer.\n\nA separate vulnerable sink was present in the Open raw JSON functionality. The raw object associated with a graph node was inserted into a new document using document.write() and an interpolated HTML string. Crafted JSON content could therefore break out of the intended \u003cpre\u003e element and inject executable markup. The fix replaced this construction with DOM APIs and assigns the JSON using textContent.\n\nThe initial correction did not cover all Pivotick rendering paths. A subsequent patch addressed additional XSS vectors in the graph properties panel. Values derived from the original CTI object\u2014including property names, property values, hash algorithm names, child attributes, edge properties, and STIX object types\u2014could still reach Pivotick\u0027s HTML resolver. According to the patch, Pivotick\u0027s tryResolveHTMLElement processes string values using template.innerHTML, allowing malicious markup to execute when a graph node is hovered over or selected.\n\nThe complete remediation therefore:\n\n  *  HTML-escapes node labels, node sublabels, and edge labels before they are passed to Pivotick.\n  *  Restricts graph node type values to a safe identifier character set.\n  *  Wraps node and edge property values in DOM elements populated through textContent, preventing Pivotick from treating attacker-controlled strings as HTML.\n  *  Replaces the raw-JSON popup\u0027s interpolated document.write() with DOM construction and textContent."
        }
      ],
      "impacts": [
        {
          "capecId": "CAPEC-63",
          "descriptions": [
            {
              "lang": "en",
              "value": "CAPEC-63 Cross-Site Scripting (XSS)"
            }
          ]
        }
      ],
      "metrics": [
        {
          "cvssV4_0": {
            "Automatable": "NOT_DEFINED",
            "Recovery": "NOT_DEFINED",
            "Safety": "NOT_DEFINED",
            "attackComplexity": "LOW",
            "attackRequirements": "NONE",
            "attackVector": "NETWORK",
            "baseScore": 5.1,
            "baseSeverity": "MEDIUM",
            "privilegesRequired": "NONE",
            "providerUrgency": "NOT_DEFINED",
            "subAvailabilityImpact": "NONE",
            "subConfidentialityImpact": "NONE",
            "subIntegrityImpact": "NONE",
            "userInteraction": "ACTIVE",
            "valueDensity": "NOT_DEFINED",
            "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N",
            "version": "4.0",
            "vulnAvailabilityImpact": "NONE",
            "vulnConfidentialityImpact": "LOW",
            "vulnIntegrityImpact": "LOW",
            "vulnerabilityResponseEffort": "NOT_DEFINED"
          },
          "format": "CVSS",
          "scenarios": [
            {
              "lang": "en",
              "value": "GENERAL"
            }
          ]
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-79",
              "description": "CWE-79 Improper Neutralization of Input During Web Page Generation (XSS or \u0027Cross-site Scripting\u0027)",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-08-10T13:58:57.154Z",
        "orgId": "5a6e4751-2f3f-4070-9419-94fb35b644e8",
        "shortName": "CIRCL"
      },
      "references": [
        {
          "tags": [
            "patch"
          ],
          "url": "https://github.com/MISP/cti-transmute/commit/b50451a746c9959efa508aeaa4a822d122687e35"
        },
        {
          "tags": [
            "patch"
          ],
          "url": "https://github.com/MISP/cti-transmute/commit/d34ccac5d82a642389390187fb3455112cbce886"
        }
      ],
      "source": {
        "discovery": "UNKNOWN"
      },
      "title": "Stored Cross-Site Scripting in CTI-Transmute Conversion Graph via Malicious STIX/MISP Content",
      "x_generator": {
        "engine": "Vulnogram 0.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "5a6e4751-2f3f-4070-9419-94fb35b644e8",
    "assignerShortName": "CIRCL",
    "cveId": "CVE-2026-72751",
    "datePublished": "2026-08-10T13:58:57.154Z",
    "dateReserved": "2026-08-10T13:58:29.653Z",
    "dateUpdated": "2026-08-10T17:54:24.703Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2",
  "vulnerability-lookup:meta": {
    "vulnrichment": {
      "containers": "{\"adp\": [{\"title\": \"CISA ADP Vulnrichment\", \"metrics\": [{\"other\": {\"type\": \"ssvc\", \"content\": {\"id\": \"CVE-2026-72751\", \"role\": \"CISA Coordinator\", \"options\": [{\"Exploitation\": \"none\"}, {\"Automatable\": \"no\"}, {\"Technical Impact\": \"partial\"}], \"version\": \"2.0.3\", \"timestamp\": \"2026-08-10T17:54:12.313929Z\"}}}], \"providerMetadata\": {\"orgId\": \"134c704f-9b21-4f2e-91b3-4a467353bcc0\", \"shortName\": \"CISA-ADP\", \"dateUpdated\": \"2026-08-10T17:54:18.619Z\"}}], \"cna\": {\"title\": \"Stored Cross-Site Scripting in CTI-Transmute Conversion Graph via Malicious STIX/MISP Content\", \"source\": {\"discovery\": \"UNKNOWN\"}, \"credits\": [{\"lang\": \"en\", \"type\": \"finder\", \"value\": \"Jeroen Pinoy\"}, {\"lang\": \"en\", \"type\": \"remediation developer\", \"value\": \"Christian Studer\"}], \"impacts\": [{\"capecId\": \"CAPEC-63\", \"descriptions\": [{\"lang\": \"en\", \"value\": \"CAPEC-63 Cross-Site Scripting (XSS)\"}]}], \"metrics\": [{\"format\": \"CVSS\", \"cvssV4_0\": {\"Safety\": \"NOT_DEFINED\", \"version\": \"4.0\", \"Recovery\": \"NOT_DEFINED\", \"baseScore\": 5.1, \"Automatable\": \"NOT_DEFINED\", \"attackVector\": \"NETWORK\", \"baseSeverity\": \"MEDIUM\", \"valueDensity\": \"NOT_DEFINED\", \"vectorString\": \"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N\", \"providerUrgency\": \"NOT_DEFINED\", \"userInteraction\": \"ACTIVE\", \"attackComplexity\": \"LOW\", \"attackRequirements\": \"NONE\", \"privilegesRequired\": \"NONE\", \"subIntegrityImpact\": \"NONE\", \"vulnIntegrityImpact\": \"LOW\", \"subAvailabilityImpact\": \"NONE\", \"vulnAvailabilityImpact\": \"NONE\", \"subConfidentialityImpact\": \"NONE\", \"vulnConfidentialityImpact\": \"LOW\", \"vulnerabilityResponseEffort\": \"NOT_DEFINED\"}, \"scenarios\": [{\"lang\": \"en\", \"value\": \"GENERAL\"}]}], \"affected\": [{\"repo\": \"https://github.com/MISP/cti-transmute\", \"vendor\": \"misp\", \"product\": \"cti-transmute\", \"versions\": [{\"status\": \"affected\", \"version\": \"0\", \"versionType\": \"semver\", \"lessThanOrEqual\": \"1.4.0\"}], \"defaultStatus\": \"unaffected\"}], \"references\": [{\"url\": \"https://github.com/MISP/cti-transmute/commit/b50451a746c9959efa508aeaa4a822d122687e35\", \"tags\": [\"patch\"]}, {\"url\": \"https://github.com/MISP/cti-transmute/commit/d34ccac5d82a642389390187fb3455112cbce886\", \"tags\": [\"patch\"]}], \"x_generator\": {\"engine\": \"Vulnogram 0.2.0\"}, \"descriptions\": [{\"lang\": \"en\", \"value\": \"CTI-Transmute is affected by a stored cross-site scripting (XSS) vulnerability in the conversion graph used to visualise converted MISP and STIX content.\\n\\nAttacker-controlled values originating from converted CTI data were passed to multiple HTML-parsing sinks in the graph user interface without sufficient neutralisation. In particular, node labels, node sublabels, edge labels, node properties, edge properties, and node types could contain crafted HTML or JavaScript content.\\n\\nThe Pivotick graph library renders some of these values through HTML-parsing operations. Consequently, a malicious value such as an HTML element containing an event handler could be interpreted as markup rather than displayed as plain text. The first remediation explicitly notes that Pivotick rendered node and edge labels as HTML and therefore introduced escaping before data was handed to the graph renderer.\\n\\nA separate vulnerable sink was present in the Open raw JSON functionality. The raw object associated with a graph node was inserted into a new document using document.write() and an interpolated HTML string. Crafted JSON content could therefore break out of the intended \u003cpre\u003e element and inject executable markup. The fix replaced this construction with DOM APIs and assigns the JSON using textContent.\\n\\nThe initial correction did not cover all Pivotick rendering paths. A subsequent patch addressed additional XSS vectors in the graph properties panel. Values derived from the original CTI object\\u2014including property names, property values, hash algorithm names, child attributes, edge properties, and STIX object types\\u2014could still reach Pivotick\u0027s HTML resolver. According to the patch, Pivotick\u0027s tryResolveHTMLElement processes string values using template.innerHTML, allowing malicious markup to execute when a graph node is hovered over or selected.\\n\\nThe complete remediation therefore:\\n\\n  *  HTML-escapes node labels, node sublabels, and edge labels before they are passed to Pivotick.\\n  *  Restricts graph node type values to a safe identifier character set.\\n  *  Wraps node and edge property values in DOM elements populated through textContent, preventing Pivotick from treating attacker-controlled strings as HTML.\\n  *  Replaces the raw-JSON popup\u0027s interpolated document.write() with DOM construction and textContent.\", \"supportingMedia\": [{\"type\": \"text/html\", \"value\": \"\u003cp\u003eCTI-Transmute is affected by a stored cross-site scripting (XSS) vulnerability in the conversion graph used to visualise converted MISP and STIX content.\u003c/p\u003e\u003cp\u003eAttacker-controlled values originating from converted CTI data were passed to multiple HTML-parsing sinks in the graph user interface without sufficient neutralisation. In particular, node labels, node sublabels, edge labels, node properties, edge properties, and node types could contain crafted HTML or JavaScript content.\u003c/p\u003e\u003cp\u003eThe Pivotick graph library renders some of these values through HTML-parsing operations. Consequently, a malicious value such as an HTML element containing an event handler could be interpreted as markup rather than displayed as plain text. The first remediation explicitly notes that Pivotick rendered node and edge labels as HTML and therefore introduced escaping before data was handed to the graph renderer.\u003c/p\u003e\u003cp\u003eA separate vulnerable sink was present in the \u003cstrong\u003eOpen raw JSON\u003c/strong\u003e functionality. The raw object associated with a graph node was inserted into a new document using \u003ccode\u003edocument.write()\u003c/code\u003e and an interpolated HTML string. Crafted JSON content could therefore break out of the intended \u003ccode\u003e\u0026lt;pre\u0026gt;\u003c/code\u003e element and inject executable markup. The fix replaced this construction with DOM APIs and assigns the JSON using \u003ccode\u003etextContent\u003c/code\u003e.\u003c/p\u003e\u003cp\u003eThe initial correction did not cover all Pivotick rendering paths. A subsequent patch addressed additional XSS vectors in the graph properties panel. Values derived from the original CTI object\\u2014including property names, property values, hash algorithm names, child attributes, edge properties, and STIX object types\\u2014could still reach Pivotick\u0027s HTML resolver. According to the patch, Pivotick\u0027s \u003ccode\u003etryResolveHTMLElement\u003c/code\u003e processes string values using \u003ccode\u003etemplate.innerHTML\u003c/code\u003e, allowing malicious markup to execute when a graph node is hovered over or selected.\u003c/p\u003e\u003cp\u003eThe complete remediation therefore:\u003c/p\u003e\u003cul\u003e\u003cli\u003eHTML-escapes node labels, node sublabels, and edge labels before they are passed to Pivotick.\u003c/li\u003e\u003cli\u003eRestricts graph node \u003ccode\u003etype\u003c/code\u003e values to a safe identifier character set.\u003c/li\u003e\u003cli\u003eWraps node and edge property values in DOM elements populated through \u003ccode\u003etextContent\u003c/code\u003e, preventing Pivotick from treating attacker-controlled strings as HTML.\u003c/li\u003e\u003cli\u003eReplaces the raw-JSON popup\u0027s interpolated \u003ccode\u003edocument.write()\u003c/code\u003e with DOM construction and \u003ccode\u003etextContent\u003c/code\u003e.\u003c/li\u003e\u003c/ul\u003e\u003cp\u003e\u003c/p\u003e\", \"base64\": false}]}], \"problemTypes\": [{\"descriptions\": [{\"lang\": \"en\", \"type\": \"CWE\", \"cweId\": \"CWE-79\", \"description\": \"CWE-79 Improper Neutralization of Input During Web Page Generation (XSS or \u0027Cross-site Scripting\u0027)\"}]}], \"providerMetadata\": {\"orgId\": \"5a6e4751-2f3f-4070-9419-94fb35b644e8\", \"shortName\": \"CIRCL\", \"dateUpdated\": \"2026-08-10T13:58:57.154Z\"}}}",
      "cveMetadata": "{\"cveId\": \"CVE-2026-72751\", \"state\": \"PUBLISHED\", \"dateUpdated\": \"2026-08-10T17:54:24.703Z\", \"dateReserved\": \"2026-08-10T13:58:29.653Z\", \"assignerOrgId\": \"5a6e4751-2f3f-4070-9419-94fb35b644e8\", \"datePublished\": \"2026-08-10T13:58:57.154Z\", \"assignerShortName\": \"CIRCL\"}",
      "dataType": "CVE_RECORD",
      "dataVersion": "5.2"
    }
  }
}