Vulnerability Description
Affected versions of cti-transmute fail to HTML-escape attacker-controlled values used in ECharts Sunburst and Treemap tooltip formatters. Slice names may originate directly from STIX or MISP data, including STIX types, relationship_type, pattern prefixes, and MISP category/type values. Since ECharts interprets the formatter return value as HTML, crafted values can inject markup or script-capable content into the tooltip. An attacker who can cause malicious conversion data to be processed can therefore inject content that executes when another user views the visualization and hovers over the affected slice. The patch replaces direct interpolation with dedicated formatter functions that call escapeHtml() on p.name, p.data.value, and p.value.
Related Weaknesses (CWE)
References
FAQ
What is CVE-2026-73156?
CVE-2026-73156 is a documented vulnerability. Affected versions of cti-transmute fail to HTML-escape attacker-controlled values used in ECharts Sunburst and Treemap tooltip formatters. Slice names may originate directly from STIX or MISP data, in...
How severe is CVE-2026-73156?
CVSS scoring is not yet available for CVE-2026-73156. Check NVD for updates.
Is there a patch for CVE-2026-73156?
Check the references section above for vendor advisories and patch information. Review vendor security bulletins for remediation guidance.