CVE-2026-73156: cti-transmute Sunburst and Treemap Tooltips Allow Cross-Site Scripting via Crafted Conversion Data
Affected versions of cti-transmute fail to HTML-escape attacker-controlled values used in ECharts Sunburst and Treemap tooltip formatters. Slice names may originate directly from STIX or MISP data, including STIX types, relationshiptype, pattern prefixes, and MISP category/type values. Since ECharts interprets the formatter return value as HTML, crafted values can inject markup or script-capable content into the tooltip.
An attacker who can cause malicious conversion data to be processed can therefore inject content that executes when another user views the visualization and hovers over the affected slice. The patch replaces direct interpolation with dedicated formatter functions that call escapeHtml() on p.name, p.data.value, and p.value.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2026-73156?
CVE-2026-73156 has a risk rating of 32, indicating a moderate level of severity.
What type of vulnerability is CVE-2026-73156?
CVE-2026-73156 is classified as a Cross-Site Scripting (XSS) vulnerability.
How do I fix CVE-2026-73156?
To fix CVE-2026-73156, ensure that cti-transmute HTML-escapes all attacker-controlled values used in ECharts tooltip formatters.
Which versions of cti-transmute are affected by CVE-2026-73156?
Affected versions of cti-transmute are those that do not properly escape values in ECharts Sunburst and Treemap tooltip formatters.
What data can trigger CVE-2026-73156?
CVE-2026-73156 can be triggered by crafted conversion data including STIX or MISP data elements such as slice names and pattern prefixes.