This vulnerability involves improper neutralization of input during web page generation (CWE-79) in the notification panel of CTI Transmute in misp. Specifically, user-controlled convert names included in notification messages were inserted into the notification bell dropdown using innerHTML without adequate sanitization. An attacker able to influence a convert name could inject JavaScript that executes in the browser of an authenticated user viewing the notification panel. The issue was fixed by constructing notification elements through DOM methods and assigning content via textContent instead of innerHTML. The vulnerability was only present on a development branch and is not known to affect released versions.

Successful exploitation could allow an attacker to execute arbitrary JavaScript in the context of an authenticated user's browser session. This could enable actions performed with the victim's privileges or access to information available to the application in the browser. However, the vulnerability was limited to a development branch and is not known to be present in production releases. There are no known exploits in the wild.

The vulnerability has been remediated by changing the notification rendering code to use safe DOM methods and textContent instead of innerHTML. Since this issue was only present on a development branch, users of official releases are not affected. No additional mitigation is required for production deployments. Patch status is not explicitly stated; check the vendor advisory or development branch updates for the fixed code.