This vulnerability in MISP cti-transmute (<=1.4.0) involves improper neutralization of input (CWE-79 and CWE-116) when rendering data obtained from remote MISP instances. The affected interface uses HTML interpolation to display fields like event IDs, organization names, tags, and labels, which can be controlled by the remote server. A malicious or compromised remote MISP instance can craft values that inject HTML or script-capable content, leading to cross-site scripting. The patch notes indicate that safe DOM methods like textContent replace string-built HTML, and tag colors are restricted to six-digit hex values to prevent malicious CSS injection. No official patch or remediation level is stated in the advisory.

An attacker controlling a remote MISP instance can inject malicious HTML or scripts into the cti-transmute event-browser interface of a client using affected versions, potentially leading to cross-site scripting attacks. This could allow execution of arbitrary scripts in the context of the affected user's browser session. However, the CVSS score of 2.3 and the low severity rating indicate limited impact, possibly due to required user interaction and partial vector complexity.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. The vendor notes that safe coding practices such as avoiding innerHTML and using textContent for DOM population, as well as restricting tag color inputs, are part of the fix. Users should monitor the official MISP project for updates or patches addressing this vulnerability and avoid using untrusted remote MISP instances until a fix is applied.