CVE-2026-73156

The CVE describes a stored XSS in cti-transmute's ECharts visualization layer, where values from STIX and MISP threat feeds render as HTML in tooltip formatters without sanitization. The CVSS of 5.3 reflects the hover-to-trigger interaction requirement, but this badly undersells the actual risk. The real vulnerability isn't a missing escapeHtml() call—it's a broken trust model. This tool ingests external threat intelligence data (STIX, MISP, vendor feeds, ISAC sharing) and passes values like relationship_type and pattern prefixes directly into ECharts formatters that render as HTML. When an analyst views a sunburst visualization of their threat landscape, they're rendering untrusted third-party data as HTML with no sanitization layer. If a threat feed aggregator gets breached, or a shared MISP instance accepts a malicious contribution, that poisoned data flows directly into analyst workstations. One compromised feed gives persistent access to every analyst who subscribes to it—the victims choose the attacker by simply doing their job. The patch adds escapeHtml() at the formatter level. This is correct but insufficient. It creates a localized fix that future contributors won't know exists, and it won't generalize when someone adds a new visualization type. The underlying data model has no concept of 'this string originated from an external feed.' What you should implement: treat all external CTI data as untrusted input with explicit sanitization boundaries, not as metadata 'about threats' that can be safely rendered. What to check: locate any ECharts formatter functions in cti-transmute that return string values derived from STIX/MISP objects—particularly those handling relationship_type, pattern prefixes, and similar metadata fields. Verify escapeHtml() is applied to any value that will render in a tooltip, label, or any HTML-context surface. More broadly, audit your CTI pipeline for other visualization or export pathways that may make the same trust assumption about external feeds. The CVSS misses the supply-chain dimension—this is exploitable through feed compromise, not just direct tool exploitation.

Reviewed through automated stages and approved by a human before publication.