CVE-2026-72751 describes a stored cross-site scripting (XSS) vulnerability in the CTI-Transmute component of misp. The vulnerability occurs because attacker-controlled values from converted CTI data are passed without sufficient escaping to HTML-parsing sinks in the graph user interface, including node labels, sublabels, edge labels, properties, and types. The Pivotick graph library renders these values as HTML, allowing malicious markup or JavaScript to execute. Additionally, the Open raw JSON feature uses document.write() with interpolated HTML, enabling crafted JSON to break out of intended containment and execute code. Initial patches introduced escaping and replaced unsafe document.write() usage with safer DOM APIs, but some rendering paths remained vulnerable until subsequent patches addressed additional XSS vectors in the graph properties panel. The final remediation includes HTML-escaping labels, restricting node type characters, wrapping property values with textContent, and replacing document.write() with DOM construction. The vulnerability affects versions up to and including 1.4.0. No explicit vendor advisory or patch link is provided, and the remediation level is not confirmed.

Exploitation of this vulnerability could allow an attacker to execute arbitrary JavaScript in the context of the affected application's user interface by injecting malicious HTML or script code into graph visualization elements or raw JSON views. This could lead to actions such as session hijacking, unauthorized actions, or information disclosure within the application. The CVSS 4.0 vector indicates network attack vector, low complexity, no privileges required, user interaction required, and low impact on confidentiality and integrity, with no impact on availability.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. The described remediation involves HTML-escaping all user-controllable labels before rendering, restricting node type values to safe characters, wrapping property values using textContent to prevent HTML interpretation, and replacing document.write() usage with safer DOM APIs. Users should monitor the official misp project advisories for patches addressing these XSS issues and apply updates accordingly once available.