In MISP cti-transmute versions <=1.4.0, a cross-site scripting vulnerability exists due to improper neutralization of user input in tag icon values. The helper function mapIcon() constructed HTML strings directly from user-supplied icon names interpolated into <i> elements via Vue's v-html directive. An attacker could craft icon values that break out of the intended markup and inject arbitrary HTML, which executes when the tag is rendered, including in administrative interfaces. The patch replaces v-html with safer Vue :class bindings, restricts mapIcon() output to valid FontAwesome class strings, and adds backend validation against the FontAwesome catalogue or a strict slug pattern before storing icons.

An attacker can inject malicious HTML and JavaScript into the application interface by supplying crafted icon values for tags. This could lead to execution of arbitrary scripts in the context of the victim's browser, potentially enabling session hijacking, credential theft, or other client-side attacks. The vulnerability affects the administrative triage interface and any other views rendering the affected tags.

A fix is available that replaces the vulnerable v-html usage with Vue :class binding, constrains icon values to valid FontAwesome classes, and validates input on the backend before storage. Users should upgrade to a version later than 1.4.0 where these mitigations are implemented. Patch status is not explicitly confirmed in the vendor advisory content provided, so check the vendor advisory for current remediation guidance.