MISP cti-transmute versions <=1.4.0 fail to properly neutralize attacker-controlled input used in ECharts tooltip formatters for Sunburst and Treemap visualizations. Slice names derived from STIX or MISP data, such as STIX types, relationship_type, pattern prefixes, and MISP category/type values, are directly interpolated without HTML escaping. Since ECharts interprets tooltip formatter return values as HTML, this allows injection of malicious markup or script content. An attacker able to influence conversion data can cause script execution when another user views and hovers over the affected visualization slice. The vulnerability is addressed by replacing direct interpolation with formatter functions that call escapeHtml() on relevant data fields.

An attacker who can supply malicious conversion data to the affected cti-transmute instance can inject HTML or script code into visualization tooltips. This code executes in the context of users viewing the visualization, potentially leading to cross-site scripting attacks. The impact includes possible session hijacking, information disclosure, or other client-side attacks. The CVSS 4.0 score is 5.3 (medium severity), reflecting network attack vector, no privileges required, user interaction needed, and limited confidentiality and integrity impact.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. The vulnerability is fixed by replacing direct interpolation with dedicated formatter functions that escape HTML entities in tooltip data. Until an official fix is available, avoid processing untrusted conversion data or displaying affected visualizations to untrusted users. Monitor vendor channels for patch releases and apply updates promptly once available.