Threats Tagged 'cve-2026-71502'

CTI-Transmute (misp cti-transmute) contains a stored cross-site scripting (XSS) vulnerability due to insufficient neutralization of Vue template expression delimiters in server-rendered user-controlled data. An unauthenticated attacker can inject malicious Vue expressions into public conversion names or descriptions, which are then executed in the context of other users viewing the affected pages. This allows arbitrary JavaScript execution despite the presence of a nonce-based Content Security Policy because the Vue runtime compiler requires unsafe-eval. Exploitation can lead to data access, session hijacking, modification of application data, and potential targeting of administrators. The vulnerability affects versions up to and including 1.5.0. A patch has been developed that inserts a zero-width Unicode word joiner inside Vue delimiters to prevent expression evaluation, but no official fix status is confirmed in the provided data.