CVE-2026-73159— cti-transmute 管理界面存储型XSS漏洞
Possible ATT&CK Techniques 2AI
T1133 · External Remote Services T1059 · Command and Scripting Interpreter新しい脆弱性情報の通知を購読するログインして購読
I. CVE-2026-73159の基本情報
脆弱性情報
脆弱性についてご質問がありますか？Shenlongの分析が参考になるかご確認ください！
Shenlongの10の質問を表示 ↗ 高度な大規模言語モデル技術を使用していますが、出力には不正確または古い情報が含まれる可能性があります。Shenlongはデータの正確性を確保するよう努めていますが、実際の状況に基づいて検証・判断してください。
脆弱性タイトル
cti-transmute Stored XSS via Crafted Tag Icon on Admin Triage Interface
ソース: CVE Program / CVE List V5
脆弱性説明
Affected versions of cti-transmute allow a tag's icon value to be stored and later interpolated into HTML through Vue's v-html. The helper mapIcon() previously constructed an HTML string directly from the icon value: <i class="fas fa-${name}"></i> Because the icon is user-supplied, a crafted value could break out of the intended markup and inject attacker-controlled HTML. When the affected tag was later rendered, including on the administrative triage interface, the payload could execute in the viewer's browser. The patch mitigates the issue at multiple layers: v-html is replaced with Vue :class binding, mapIcon() now returns only a constrained FontAwesome class string, and the backend validates icons against the FontAwesome catalogue or a strict [a-z0-9-]{1,40} slug pattern before storing them.
ソース: CVE Program / CVE List V5
CVSS情報
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:P/VC:L/VI:L/VA:N/SC:L/SI:L/SA:N
ソース: CVE Program / CVE List V5
脆弱性タイプ
在Web页面生成时对输入的转义处理不恰当(跨站脚本)
ソース: CVE Program / CVE List V5
影響を受ける製品
| ベンダー | プロダクト | 影響を受けるバージョン | CPE | 購読 |
|---|---|---|---|---|
| MISP | cti-transmute | 0 ~ 1.4.0 | - |
II. CVE-2026-73159の公開POC
| # | POC説明 | ソースリンク | Shenlongリンク |
|---|
AI生成POCプレミアム
公開POCは見つかりませんでした。
ログインしてAI POCを生成III. CVE-2026-73159のインテリジェンス情報
请登录查看更多情报信息。
CVE-2026-73159 补丁与修复 (1)
Same Patch Batch · MISP · 2026-08-11 · 9 CVEs total
| CVE-2026-73160 | 8.7 HIGH | cti-transmute Unauthenticated SSRF via Hostnames Resolving to Internal IP Addresses |
| CVE-2026-73155 | 5.3 MEDIUM | cti-transmute Missing Authorization Allows Reactions to Private Comments |
| CVE-2026-73140 | 5.3 MEDIUM | cti-transmute Evaluation Report Exports Expose Private Comments and Author Information |
| CVE-2026-73156 | 5.3 MEDIUM | cti-transmute Sunburst and Treemap Tooltips Allow Cross-Site Scripting via Crafted Convers |
| CVE-2026-73162 | 5.3 MEDIUM | cti-transmute CSRF Allows Unauthorized Follow and Notification State Changes |
| CVE-2026-73158 | 5.1 MEDIUM | cti-transmute Saved Graph Configuration Allows Stored Cross-Site Scripting via svgIcon |
| CVE-2026-73161 | 5.1 MEDIUM | cti-transmute Conversion Table Allows XSS via Unescaped Cell Content During Search Highlig |
| CVE-2026-73157 | 2.3 LOW | cti-transmute Remote MISP Event Browser Allows Cross-Site Scripting via Malicious Event Me |
IV. 関連脆弱性
同じ製品: cti-transmute
- CVE-2026-73162
cti-transmute CSRF Allows Unauthorized Follow and Notificati - CVE-2026-73161
cti-transmute Conversion Table Allows XSS via Unescaped Cell - CVE-2026-73160
cti-transmute Unauthenticated SSRF via Hostnames Resolving t - CVE-2026-73158
cti-transmute Saved Graph Configuration Allows Stored Cross- - CVE-2026-73157
cti-transmute Remote MISP Event Browser Allows Cross-Site Sc
同じベンダー: MISP
- CVE-2026-73162
cti-transmute CSRF Allows Unauthorized Follow and Notificati - CVE-2026-73161
cti-transmute Conversion Table Allows XSS via Unescaped Cell - CVE-2026-73160
cti-transmute Unauthenticated SSRF via Hostnames Resolving t - CVE-2026-73158
cti-transmute Saved Graph Configuration Allows Stored Cross- - CVE-2026-73157
cti-transmute Remote MISP Event Browser Allows Cross-Site Sc
同じ弱点: CWE-79
- CVE-2026-72747
AVideo Stored Cross-Site Scripting via Unauthenticated Regis - CVE-2026-72559
Daniel Brendel HortusFox - Cross-Site Scripting - CVE-2026-72553
ElkArte Forum ElkArte - Cross-Site Scripting - CVE-2026-73161
cti-transmute Conversion Table Allows XSS via Unescaped Cell - CVE-2026-73158
cti-transmute Saved Graph Configuration Allows Stored Cross-
V. CVE-2026-73159へのコメント
まだコメントはありません