The vulnerability in MISP cti-transmute (<=1.4.0) involves improper neutralization of input during web page generation (CWE-79). Specifically, saved graph configurations can contain style properties, including svgIcon, which Pivotick interprets as HTML. Because these configurations may be shared across users, a malicious user can inject script code via a crafted svgIcon value, leading to cross-site scripting when viewed by others. The fix introduces a strict schema on server and client sides, limiting style entries to safe properties and explicitly rejecting svgIcon and iconClass. Existing stored configurations are sanitized both when listed and before application in the browser.

This vulnerability allows a user with permission to save graph configurations to inject malicious scripts that execute in the browsers of other users who view those configurations, including administrators. This can lead to unauthorized actions performed in the context of the victim's session. The CVSS 4.0 base score is 5.1, indicating medium severity with network attack vector, low complexity, and requiring user interaction and low privileges.

No official patch or remediation level is currently confirmed. Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. The described fix involves enforcing a strict configuration schema rejecting dangerous properties and sanitizing existing stored configurations. Until an official fix is available, restrict permissions to save or modify graph configurations to trusted users only and avoid viewing untrusted configurations.