The vulnerability in MISP cti-transmute (<=1.4.0) involves improper neutralization of input during web page generation (CWE-79 and CWE-116). Specifically, the highlight() function used in the search highlighting feature returns text directly or performs regex replacements that insert <mark> tags without escaping the original content. This allows malicious markup in conversion data to be interpreted as HTML, leading to a cross-site scripting (XSS) vulnerability. The fix described involves introducing a highlightMatches() helper function that escapes special characters such as <, >, &, and quotes before inserting the <mark> element, preventing HTML interpretation of user-controlled content.

An attacker could exploit this vulnerability by injecting malicious markup into conversion data that is then rendered in the search highlighting feature, potentially leading to cross-site scripting attacks. This could allow execution of arbitrary scripts in the context of the affected web application, impacting confidentiality and integrity of user interactions. The CVSS 4.0 score of 5.1 reflects a medium severity with network attack vector, low complexity, and requiring user interaction and low privileges.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. The described fix involves escaping special characters before inserting <mark> tags in the search highlighting feature. Until an official patch is available, users should monitor vendor communications for updates and consider restricting input or usage of the affected feature if feasible.