CVE-2026-71502 is a stored cross-site scripting vulnerability in misp cti-transmute caused by improper neutralization of Vue template delimiters ([[ ... ]]) in server-rendered user input. Attackers can create public conversions with malicious Vue expressions in their name or description fields, which are then interpreted by the Vue runtime compiler as executable code. The vulnerability bypasses nonce-based Content Security Policy restrictions because Vue requires the unsafe-eval policy exception. The malicious payload is stored and executed when other users access the affected pages, enabling arbitrary JavaScript execution in the application's origin context. This can lead to unauthorized data access, extraction of sensitive tokens, session hijacking, data modification, and escalation by targeting administrators. The patch approach involves inserting a zero-width Unicode word joiner inside Vue delimiters to break expression recognition while preserving visible text. Affected versions are all versions up to and including 1.5.0. No official remediation level or patch availability is stated in the provided data.

Successful exploitation allows an unauthenticated attacker to execute arbitrary JavaScript in the security context of the CTI-Transmute application. This can result in unauthorized access to data available to the victim user, extraction of API keys or tokens, performing actions with the victim's session privileges, modification of application data such as conversions, and potential escalation by targeting administrative users. The vulnerability is stored and triggers upon victim access to affected pages, increasing the risk to multiple users.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. The vulnerability is addressed by a patch that inserts a zero-width Unicode word joiner inside Vue delimiters in server-rendered values to prevent Vue from interpreting user input as template expressions. Until an official fix is confirmed and applied, users should exercise caution with public conversions and consider restricting access or sanitizing inputs. Monitor vendor communications for an official patch or update.