CVE-2026-73159: cti-transmute Stored XSS via Crafted Tag Icon on Admin Triage Interface
Affected versions of cti-transmute allow a tag's icon value to be stored and later interpolated into HTML through Vue's v-html. The helper mapIcon() previously constructed an HTML string directly from the icon value:
<i class="fas fa-${name}"></i>
Because the icon is user-supplied, a crafted value could break out of the intended markup and inject attacker-controlled HTML. When the affected tag was later rendered, including on the administrative triage interface, the payload could execute in the viewer's browser.
The patch mitigates the issue at multiple layers: v-html is replaced with Vue :class binding, mapIcon() now returns only a constrained FontAwesome class string, and the backend validates icons against the FontAwesome catalogue or a strict [a-z0-9-]{1,40} slug pattern before storing them.
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Configuration
Update the tag icon rendering to stop using Vue's v-html with the user-supplied icon value and instead use a Vue :class binding so the icon cannot inject HTML.
cti-transmute (frontend Vue) Use v-html for icon rendering = Replace with Vue :class binding - Configuration
Modify helper mapIcon() so it no longer constructs an HTML string from the icon value; instead it must return only a constrained FontAwesome class string.
cti-transmute (frontend) mapIcon() output construction = Return constrained FontAwesome class string only - Configuration
On the backend, validate the user-supplied icon against the FontAwesome catalogue OR a strict icon slug pattern [a-z0-9-]{1,40} before storing it.
cti-transmute (backend) Icon validation before storing = Validate against FontAwesome catalogue or strict [a-z0-9-]{1,40} slug pattern - Compensating control
Apply the above fixes across both the viewer and the administrative triage interface to prevent stored XSS from executing in the administrator's browser.