CVE-2026-72751

CVE-2026-72751 in CTI-Transmute required three sequential patches to fully close—an HTML-escaping fix for labels that missed property panels, a second patch for those panels, and a third for document.write() with string interpolation in the raw JSON viewer. The sequential discovery pattern is the alarm here, not the specific XSS vectors. The root failure is architectural: CTI-Transmute treats MISP and STIX objects as structured data rather than untrusted input. These formats are standardized, which creates false confidence—the assumption that organized data is safe data. It is not. CTI sharing is precisely the attack surface where adversaries inject malicious content, expecting recipients to render it without sanitization. A STIX object carrying a crafted node label is functionally no different from an email HTML body: the structure earns trust it hasn't earned. The document.write() sink is a twenty-year-old vulnerability pattern that keeps recurring in CTI tooling because the ecosystem has failed to build institutional memory around web rendering risks. Pivotick's HTML-by-default design compounds this—rendering pretty nodes is the product, so unsafe rendering is the path of least resistance. Every caller owns sanitization whether they know it or not. The blast radius of this vulnerability exceeds what CVSS 5.1 suggests. CTI-Transmute converts between MISP and STIX for inter-organizational sharing. Each partial patch window created a detonation opportunity that propagated through the CTI sharing network—a label patch deployed while the JSON viewer remained vulnerable meant organizations importing that output were still exposed. The sequential patches weren't just fixing bugs; they were revealing exposure windows to attackers monitoring the project's release history. Prioritize these actions: audit all CTI visualization integrations for document.write() or innerHTML usage with dynamic string parameters, treat all MISP/STIX content as untrusted regardless of format validation, and implement taint propagation from CTI ingestion to all rendering sinks. The CTI sharing graph amplifies simple flaws at high-traffic intersections; a basic XSS in a converter has more collateral damage potential than the same flaw in an internal tool.

Reviewed through automated stages and approved by a human before publication.