CVE-2026-73159

{
  "id": "CVE-2026-73159",
  "sourceIdentifier": "5a6e4751-2f3f-4070-9419-94fb35b644e8",
  "published": "2026-08-11T09:17:14.897",
  "lastModified": "2026-10-24T15:10:00.190",
  "vulnStatus": "Deferred",
  "cveTags": [],
  "descriptions": [
    {
      "lang": "en",
      "value": "Affected versions of cti-transmute allow a tag's icon value to be stored and later interpolated into HTML through Vue's v-html. The helper mapIcon() previously constructed an HTML string directly from the icon value:\n\n\n<i class=\"fas fa-${name}\"></i>\n\n\nBecause the icon is user-supplied, a crafted value could break out of the intended markup and inject attacker-controlled HTML. When the affected tag was later rendered, including on the administrative triage interface, the payload could execute in the viewer's browser.\n\n\nThe patch mitigates the issue at multiple layers: v-html is replaced with Vue :class binding, mapIcon() now returns only a constrained FontAwesome class string, and the backend validates icons against the FontAwesome catalogue or a strict [a-z0-9-]{1,40} slug pattern before storing them."
    },
    {
      "lang": "es",
      "value": "Versiones afectadas de cti-transmute permiten que el valor del icono de una etiqueta sea almacenado y posteriormente interpolado en HTML a través de v-html de Vue. La función auxiliar mapIcon() previamente construía una cadena HTML directamente del valor del icono:\n\nmenor quei class=“fas fa-${name}”mayor que[/i]\n\nDebido a que el icono es proporcionado por el usuario, un valor manipulado podría escapar del marcado previsto e inyectar HTML controlado por el atacante. Cuando la etiqueta afectada fue renderizada posteriormente, incluyendo en la interfaz de triaje administrativo, la carga útil podría ejecutarse en el navegador del espectador.\n\nEl parche mitiga el problema en múltiples capas: v-html es reemplazado por el enlace :class de Vue, mapIcon() ahora devuelve solo una cadena de clase FontAwesome restringida, y el backend valida los iconos contra el catálogo de FontAwesome o un patrón de slug estricto [a-z0-9-]{1,40} antes de almacenarlos."
    }
  ],
  "affected": [
    {
      "source": "5a6e4751-2f3f-4070-9419-94fb35b644e8",
      "affectedData": [
        {
          "vendor": "MISP",
          "product": "cti-transmute",
          "defaultStatus": "unaffected",
          "repo": "https://github.com/MISP/cti-transmute",
          "versions": [
            {
              "version": "0",
              "lessThanOrEqual": "1.4.0",
              "versionType": "semver",
              "status": "affected"
            }
          ]
        }
      ]
    }
  ],
  "metrics": {
    "cvssMetricV40": [
      {
        "source": "5a6e4751-2f3f-4070-9419-94fb35b644e8",
        "type": "Secondary",
        "cvssData": {
          "version": "4.0",
          "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:P/VC:L/VI:L/VA:N/SC:L/SI:L/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X",
          "baseScore": 5.1,
          "baseSeverity": "MEDIUM",
          "attackVector": "NETWORK",
          "attackComplexity": "LOW",
          "attackRequirements": "NONE",
          "privilegesRequired": "LOW",
          "userInteraction": "PASSIVE",
          "vulnConfidentialityImpact": "LOW",
          "vulnIntegrityImpact": "LOW",
          "vulnAvailabilityImpact": "NONE",
          "subConfidentialityImpact": "LOW",
          "subIntegrityImpact": "LOW",
          "subAvailabilityImpact": "NONE",
          "exploitMaturity": "NOT_DEFINED",
          "confidentialityRequirement": "NOT_DEFINED",
          "integrityRequirement": "NOT_DEFINED",
          "availabilityRequirement": "NOT_DEFINED",
          "modifiedAttackVector": "NOT_DEFINED",
          "modifiedAttackComplexity": "NOT_DEFINED",
          "modifiedAttackRequirements": "NOT_DEFINED",
          "modifiedPrivilegesRequired": "NOT_DEFINED",
          "modifiedUserInteraction": "NOT_DEFINED",
          "modifiedVulnConfidentialityImpact": "NOT_DEFINED",
          "modifiedVulnIntegrityImpact": "NOT_DEFINED",
          "modifiedVulnAvailabilityImpact": "NOT_DEFINED",
          "modifiedSubConfidentialityImpact": "NOT_DEFINED",
          "modifiedSubIntegrityImpact": "NOT_DEFINED",
          "modifiedSubAvailabilityImpact": "NOT_DEFINED",
          "Safety": "NOT_DEFINED",
          "Automatable": "NOT_DEFINED",
          "Recovery": "NOT_DEFINED",
          "valueDensity": "NOT_DEFINED",
          "vulnerabilityResponseEffort": "NOT_DEFINED",
          "providerUrgency": "NOT_DEFINED"
        }
      }
    ],
    "ssvcV203": [
      {
        "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
        "ssvcData": {
          "timestamp": "2026-08-11T13:02:58.398751Z",
          "id": "CVE-2026-73159",
          "options": [
            {
              "exploitation": "none"
            },
            {
              "automatable": "no"
            },
            {
              "technicalImpact": "partial"
            }
          ],
          "role": "CISA Coordinator",
          "version": "2.0.3"
        }
      }
    ]
  },
  "weaknesses": [
    {
      "source": "5a6e4751-2f3f-4070-9419-94fb35b644e8",
      "type": "Secondary",
      "description": [
        {
          "lang": "en",
          "value": "CWE-79"
        }
      ]
    }
  ],
  "references": [
    {
      "url": "https://github.com/MISP/cti-transmute/commit/cc13416d606d91d543ce1f1e41387750f8450153",
      "source": "5a6e4751-2f3f-4070-9419-94fb35b644e8"
    }
  ]
}