CVE-2026-72751 (GCVE-0-2026-72751)
Vulnerability from cvelistv5 – Published: 2026-08-10 13:58 – Updated: 2026-08-10 17:54
VLAI
EPSS
VEX
Title
Stored Cross-Site Scripting in CTI-Transmute Conversion Graph via Malicious STIX/MISP Content
Summary
CTI-Transmute is affected by a stored cross-site scripting (XSS) vulnerability in the conversion graph used to visualise converted MISP and STIX content.
Attacker-controlled values originating from converted CTI data were passed to multiple HTML-parsing sinks in the graph user interface without sufficient neutralisation. In particular, node labels, node sublabels, edge labels, node properties, edge properties, and node types could contain crafted HTML or JavaScript content.
The Pivotick graph library renders some of these values through HTML-parsing operations. Consequently, a malicious value such as an HTML element containing an event handler could be interpreted as markup rather than displayed as plain text. The first remediation explicitly notes that Pivotick rendered node and edge labels as HTML and therefore introduced escaping before data was handed to the graph renderer.
A separate vulnerable sink was present in the Open raw JSON functionality. The raw object associated with a graph node was inserted into a new document using document.write() and an interpolated HTML string. Crafted JSON content could therefore break out of the intended <pre> element and inject executable markup. The fix replaced this construction with DOM APIs and assigns the JSON using textContent.
The initial correction did not cover all Pivotick rendering paths. A subsequent patch addressed additional XSS vectors in the graph properties panel. Values derived from the original CTI object—including property names, property values, hash algorithm names, child attributes, edge properties, and STIX object types—could still reach Pivotick's HTML resolver. According to the patch, Pivotick's tryResolveHTMLElement processes string values using template.innerHTML, allowing malicious markup to execute when a graph node is hovered over or selected.
The complete remediation therefore:
* HTML-escapes node labels, node sublabels, and edge labels before they are passed to Pivotick.
* Restricts graph node type values to a safe identifier character set.
* Wraps node and edge property values in DOM elements populated through textContent, preventing Pivotick from treating attacker-controlled strings as HTML.
* Replaces the raw-JSON popup's interpolated document.write() with DOM construction and textContent.
Severity
SSVC
Exploitation: none
Automatable: no
Technical Impact: partial
CISA Coordinator (v2.0.3)
CWE
- CWE-79 - Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting')
Assigner
References
2 references
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| misp | cti-transmute |
Affected:
0 , ≤ 1.4.0
(semver)
|
Credits
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-72751",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-08-10T17:54:12.313929Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-08-10T17:54:24.703Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "cti-transmute",
"repo": "https://github.com/MISP/cti-transmute",
"vendor": "misp",
"versions": [
{
"lessThanOrEqual": "1.4.0",
"status": "affected",
"version": "0",
"versionType": "semver"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "Jeroen Pinoy"
},
{
"lang": "en",
"type": "remediation developer",
"value": "Christian Studer"
}
],
"descriptions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "\u003cp\u003eCTI-Transmute is affected by a stored cross-site scripting (XSS) vulnerability in the conversion graph used to visualise converted MISP and STIX content.\u003c/p\u003e\u003cp\u003eAttacker-controlled values originating from converted CTI data were passed to multiple HTML-parsing sinks in the graph user interface without sufficient neutralisation. In particular, node labels, node sublabels, edge labels, node properties, edge properties, and node types could contain crafted HTML or JavaScript content.\u003c/p\u003e\u003cp\u003eThe Pivotick graph library renders some of these values through HTML-parsing operations. Consequently, a malicious value such as an HTML element containing an event handler could be interpreted as markup rather than displayed as plain text. The first remediation explicitly notes that Pivotick rendered node and edge labels as HTML and therefore introduced escaping before data was handed to the graph renderer.\u003c/p\u003e\u003cp\u003eA separate vulnerable sink was present in the \u003cstrong\u003eOpen raw JSON\u003c/strong\u003e functionality. The raw object associated with a graph node was inserted into a new document using \u003ccode\u003edocument.write()\u003c/code\u003e and an interpolated HTML string. Crafted JSON content could therefore break out of the intended \u003ccode\u003e\u0026lt;pre\u0026gt;\u003c/code\u003e element and inject executable markup. The fix replaced this construction with DOM APIs and assigns the JSON using \u003ccode\u003etextContent\u003c/code\u003e.\u003c/p\u003e\u003cp\u003eThe initial correction did not cover all Pivotick rendering paths. A subsequent patch addressed additional XSS vectors in the graph properties panel. Values derived from the original CTI object\u2014including property names, property values, hash algorithm names, child attributes, edge properties, and STIX object types\u2014could still reach Pivotick\u0027s HTML resolver. According to the patch, Pivotick\u0027s \u003ccode\u003etryResolveHTMLElement\u003c/code\u003e processes string values using \u003ccode\u003etemplate.innerHTML\u003c/code\u003e, allowing malicious markup to execute when a graph node is hovered over or selected.\u003c/p\u003e\u003cp\u003eThe complete remediation therefore:\u003c/p\u003e\u003cul\u003e\u003cli\u003eHTML-escapes node labels, node sublabels, and edge labels before they are passed to Pivotick.\u003c/li\u003e\u003cli\u003eRestricts graph node \u003ccode\u003etype\u003c/code\u003e values to a safe identifier character set.\u003c/li\u003e\u003cli\u003eWraps node and edge property values in DOM elements populated through \u003ccode\u003etextContent\u003c/code\u003e, preventing Pivotick from treating attacker-controlled strings as HTML.\u003c/li\u003e\u003cli\u003eReplaces the raw-JSON popup\u0027s interpolated \u003ccode\u003edocument.write()\u003c/code\u003e with DOM construction and \u003ccode\u003etextContent\u003c/code\u003e.\u003c/li\u003e\u003c/ul\u003e\u003cp\u003e\u003c/p\u003e"
}
],
"value": "CTI-Transmute is affected by a stored cross-site scripting (XSS) vulnerability in the conversion graph used to visualise converted MISP and STIX content.\n\nAttacker-controlled values originating from converted CTI data were passed to multiple HTML-parsing sinks in the graph user interface without sufficient neutralisation. In particular, node labels, node sublabels, edge labels, node properties, edge properties, and node types could contain crafted HTML or JavaScript content.\n\nThe Pivotick graph library renders some of these values through HTML-parsing operations. Consequently, a malicious value such as an HTML element containing an event handler could be interpreted as markup rather than displayed as plain text. The first remediation explicitly notes that Pivotick rendered node and edge labels as HTML and therefore introduced escaping before data was handed to the graph renderer.\n\nA separate vulnerable sink was present in the Open raw JSON functionality. The raw object associated with a graph node was inserted into a new document using document.write() and an interpolated HTML string. Crafted JSON content could therefore break out of the intended \u003cpre\u003e element and inject executable markup. The fix replaced this construction with DOM APIs and assigns the JSON using textContent.\n\nThe initial correction did not cover all Pivotick rendering paths. A subsequent patch addressed additional XSS vectors in the graph properties panel. Values derived from the original CTI object\u2014including property names, property values, hash algorithm names, child attributes, edge properties, and STIX object types\u2014could still reach Pivotick\u0027s HTML resolver. According to the patch, Pivotick\u0027s tryResolveHTMLElement processes string values using template.innerHTML, allowing malicious markup to execute when a graph node is hovered over or selected.\n\nThe complete remediation therefore:\n\n * HTML-escapes node labels, node sublabels, and edge labels before they are passed to Pivotick.\n * Restricts graph node type values to a safe identifier character set.\n * Wraps node and edge property values in DOM elements populated through textContent, preventing Pivotick from treating attacker-controlled strings as HTML.\n * Replaces the raw-JSON popup\u0027s interpolated document.write() with DOM construction and textContent."
}
],
"impacts": [
{
"capecId": "CAPEC-63",
"descriptions": [
{
"lang": "en",
"value": "CAPEC-63 Cross-Site Scripting (XSS)"
}
]
}
],
"metrics": [
{
"cvssV4_0": {
"Automatable": "NOT_DEFINED",
"Recovery": "NOT_DEFINED",
"Safety": "NOT_DEFINED",
"attackComplexity": "LOW",
"attackRequirements": "NONE",
"attackVector": "NETWORK",
"baseScore": 5.1,
"baseSeverity": "MEDIUM",
"privilegesRequired": "NONE",
"providerUrgency": "NOT_DEFINED",
"subAvailabilityImpact": "NONE",
"subConfidentialityImpact": "NONE",
"subIntegrityImpact": "NONE",
"userInteraction": "ACTIVE",
"valueDensity": "NOT_DEFINED",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N",
"version": "4.0",
"vulnAvailabilityImpact": "NONE",
"vulnConfidentialityImpact": "LOW",
"vulnIntegrityImpact": "LOW",
"vulnerabilityResponseEffort": "NOT_DEFINED"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-79",
"description": "CWE-79 Improper Neutralization of Input During Web Page Generation (XSS or \u0027Cross-site Scripting\u0027)",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-08-10T13:58:57.154Z",
"orgId": "5a6e4751-2f3f-4070-9419-94fb35b644e8",
"shortName": "CIRCL"
},
"references": [
{
"tags": [
"patch"
],
"url": "https://github.com/MISP/cti-transmute/commit/b50451a746c9959efa508aeaa4a822d122687e35"
},
{
"tags": [
"patch"
],
"url": "https://github.com/MISP/cti-transmute/commit/d34ccac5d82a642389390187fb3455112cbce886"
}
],
"source": {
"discovery": "UNKNOWN"
},
"title": "Stored Cross-Site Scripting in CTI-Transmute Conversion Graph via Malicious STIX/MISP Content",
"x_generator": {
"engine": "Vulnogram 0.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "5a6e4751-2f3f-4070-9419-94fb35b644e8",
"assignerShortName": "CIRCL",
"cveId": "CVE-2026-72751",
"datePublished": "2026-08-10T13:58:57.154Z",
"dateReserved": "2026-08-10T13:58:29.653Z",
"dateUpdated": "2026-08-10T17:54:24.703Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2",
"vulnerability-lookup:meta": {
"nvd": "{\"cve\":{\"id\":\"CVE-2026-72751\",\"sourceIdentifier\":\"5a6e4751-2f3f-4070-9419-94fb35b644e8\",\"published\":\"2026-08-10T14:17:31.553\",\"lastModified\":\"2026-08-10T18:18:52.877\",\"vulnStatus\":\"Received\",\"cveTags\":[],\"descriptions\":[{\"lang\":\"en\",\"value\":\"CTI-Transmute is affected by a stored cross-site scripting (XSS) vulnerability in the conversion graph used to visualise converted MISP and STIX content.\\n\\nAttacker-controlled values originating from converted CTI data were passed to multiple HTML-parsing sinks in the graph user interface without sufficient neutralisation. In particular, node labels, node sublabels, edge labels, node properties, edge properties, and node types could contain crafted HTML or JavaScript content.\\n\\nThe Pivotick graph library renders some of these values through HTML-parsing operations. Consequently, a malicious value such as an HTML element containing an event handler could be interpreted as markup rather than displayed as plain text. The first remediation explicitly notes that Pivotick rendered node and edge labels as HTML and therefore introduced escaping before data was handed to the graph renderer.\\n\\nA separate vulnerable sink was present in the Open raw JSON functionality. The raw object associated with a graph node was inserted into a new document using document.write() and an interpolated HTML string. Crafted JSON content could therefore break out of the intended \u003cpre\u003e element and inject executable markup. The fix replaced this construction with DOM APIs and assigns the JSON using textContent.\\n\\nThe initial correction did not cover all Pivotick rendering paths. A subsequent patch addressed additional XSS vectors in the graph properties panel. Values derived from the original CTI object\u2014including property names, property values, hash algorithm names, child attributes, edge properties, and STIX object types\u2014could still reach Pivotick\u0027s HTML resolver. According to the patch, Pivotick\u0027s tryResolveHTMLElement processes string values using template.innerHTML, allowing malicious markup to execute when a graph node is hovered over or selected.\\n\\nThe complete remediation therefore:\\n\\n * HTML-escapes node labels, node sublabels, and edge labels before they are passed to Pivotick.\\n * Restricts graph node type values to a safe identifier character set.\\n * Wraps node and edge property values in DOM elements populated through textContent, preventing Pivotick from treating attacker-controlled strings as HTML.\\n * Replaces the raw-JSON popup\u0027s interpolated document.write() with DOM construction and textContent.\"}],\"affected\":[{\"source\":\"5a6e4751-2f3f-4070-9419-94fb35b644e8\",\"affectedData\":[{\"vendor\":\"misp\",\"product\":\"cti-transmute\",\"defaultStatus\":\"unaffected\",\"repo\":\"https://github.com/MISP/cti-transmute\",\"versions\":[{\"version\":\"0\",\"lessThanOrEqual\":\"1.4.0\",\"versionType\":\"semver\",\"status\":\"affected\"}]}]}],\"metrics\":{\"cvssMetricV40\":[{\"source\":\"5a6e4751-2f3f-4070-9419-94fb35b644e8\",\"type\":\"Secondary\",\"cvssData\":{\"version\":\"4.0\",\"vectorString\":\"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X\",\"baseScore\":5.1,\"baseSeverity\":\"MEDIUM\",\"attackVector\":\"NETWORK\",\"attackComplexity\":\"LOW\",\"attackRequirements\":\"NONE\",\"privilegesRequired\":\"NONE\",\"userInteraction\":\"ACTIVE\",\"vulnConfidentialityImpact\":\"LOW\",\"vulnIntegrityImpact\":\"LOW\",\"vulnAvailabilityImpact\":\"NONE\",\"subConfidentialityImpact\":\"NONE\",\"subIntegrityImpact\":\"NONE\",\"subAvailabilityImpact\":\"NONE\",\"exploitMaturity\":\"NOT_DEFINED\",\"confidentialityRequirement\":\"NOT_DEFINED\",\"integrityRequirement\":\"NOT_DEFINED\",\"availabilityRequirement\":\"NOT_DEFINED\",\"modifiedAttackVector\":\"NOT_DEFINED\",\"modifiedAttackComplexity\":\"NOT_DEFINED\",\"modifiedAttackRequirements\":\"NOT_DEFINED\",\"modifiedPrivilegesRequired\":\"NOT_DEFINED\",\"modifiedUserInteraction\":\"NOT_DEFINED\",\"modifiedVulnConfidentialityImpact\":\"NOT_DEFINED\",\"modifiedVulnIntegrityImpact\":\"NOT_DEFINED\",\"modifiedVulnAvailabilityImpact\":\"NOT_DEFINED\",\"modifiedSubConfidentialityImpact\":\"NOT_DEFINED\",\"modifiedSubIntegrityImpact\":\"NOT_DEFINED\",\"modifiedSubAvailabilityImpact\":\"NOT_DEFINED\",\"Safety\":\"NOT_DEFINED\",\"Automatable\":\"NOT_DEFINED\",\"Recovery\":\"NOT_DEFINED\",\"valueDensity\":\"NOT_DEFINED\",\"vulnerabilityResponseEffort\":\"NOT_DEFINED\",\"providerUrgency\":\"NOT_DEFINED\"}}],\"ssvcV203\":[{\"source\":\"134c704f-9b21-4f2e-91b3-4a467353bcc0\",\"ssvcData\":{\"timestamp\":\"2026-08-10T17:54:12.313929Z\",\"id\":\"CVE-2026-72751\",\"options\":[{\"exploitation\":\"none\"},{\"automatable\":\"no\"},{\"technicalImpact\":\"partial\"}],\"role\":\"CISA Coordinator\",\"version\":\"2.0.3\"}}]},\"weaknesses\":[{\"source\":\"5a6e4751-2f3f-4070-9419-94fb35b644e8\",\"type\":\"Secondary\",\"description\":[{\"lang\":\"en\",\"value\":\"CWE-79\"}]}],\"references\":[{\"url\":\"https://github.com/MISP/cti-transmute/commit/b50451a746c9959efa508aeaa4a822d122687e35\",\"source\":\"5a6e4751-2f3f-4070-9419-94fb35b644e8\"},{\"url\":\"https://github.com/MISP/cti-transmute/commit/d34ccac5d82a642389390187fb3455112cbce886\",\"source\":\"5a6e4751-2f3f-4070-9419-94fb35b644e8\"}]}}",
"vulnrichment": {
"containers": "{\"adp\": [{\"title\": \"CISA ADP Vulnrichment\", \"metrics\": [{\"other\": {\"type\": \"ssvc\", \"content\": {\"id\": \"CVE-2026-72751\", \"role\": \"CISA Coordinator\", \"options\": [{\"Exploitation\": \"none\"}, {\"Automatable\": \"no\"}, {\"Technical Impact\": \"partial\"}], \"version\": \"2.0.3\", \"timestamp\": \"2026-08-10T17:54:12.313929Z\"}}}], \"providerMetadata\": {\"orgId\": \"134c704f-9b21-4f2e-91b3-4a467353bcc0\", \"shortName\": \"CISA-ADP\", \"dateUpdated\": \"2026-08-10T17:54:18.619Z\"}}], \"cna\": {\"title\": \"Stored Cross-Site Scripting in CTI-Transmute Conversion Graph via Malicious STIX/MISP Content\", \"source\": {\"discovery\": \"UNKNOWN\"}, \"credits\": [{\"lang\": \"en\", \"type\": \"finder\", \"value\": \"Jeroen Pinoy\"}, {\"lang\": \"en\", \"type\": \"remediation developer\", \"value\": \"Christian Studer\"}], \"impacts\": [{\"capecId\": \"CAPEC-63\", \"descriptions\": [{\"lang\": \"en\", \"value\": \"CAPEC-63 Cross-Site Scripting (XSS)\"}]}], \"metrics\": [{\"format\": \"CVSS\", \"cvssV4_0\": {\"Safety\": \"NOT_DEFINED\", \"version\": \"4.0\", \"Recovery\": \"NOT_DEFINED\", \"baseScore\": 5.1, \"Automatable\": \"NOT_DEFINED\", \"attackVector\": \"NETWORK\", \"baseSeverity\": \"MEDIUM\", \"valueDensity\": \"NOT_DEFINED\", \"vectorString\": \"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N\", \"providerUrgency\": \"NOT_DEFINED\", \"userInteraction\": \"ACTIVE\", \"attackComplexity\": \"LOW\", \"attackRequirements\": \"NONE\", \"privilegesRequired\": \"NONE\", \"subIntegrityImpact\": \"NONE\", \"vulnIntegrityImpact\": \"LOW\", \"subAvailabilityImpact\": \"NONE\", \"vulnAvailabilityImpact\": \"NONE\", \"subConfidentialityImpact\": \"NONE\", \"vulnConfidentialityImpact\": \"LOW\", \"vulnerabilityResponseEffort\": \"NOT_DEFINED\"}, \"scenarios\": [{\"lang\": \"en\", \"value\": \"GENERAL\"}]}], \"affected\": [{\"repo\": \"https://github.com/MISP/cti-transmute\", \"vendor\": \"misp\", \"product\": \"cti-transmute\", \"versions\": [{\"status\": \"affected\", \"version\": \"0\", \"versionType\": \"semver\", \"lessThanOrEqual\": \"1.4.0\"}], \"defaultStatus\": \"unaffected\"}], \"references\": [{\"url\": \"https://github.com/MISP/cti-transmute/commit/b50451a746c9959efa508aeaa4a822d122687e35\", \"tags\": [\"patch\"]}, {\"url\": \"https://github.com/MISP/cti-transmute/commit/d34ccac5d82a642389390187fb3455112cbce886\", \"tags\": [\"patch\"]}], \"x_generator\": {\"engine\": \"Vulnogram 0.2.0\"}, \"descriptions\": [{\"lang\": \"en\", \"value\": \"CTI-Transmute is affected by a stored cross-site scripting (XSS) vulnerability in the conversion graph used to visualise converted MISP and STIX content.\\n\\nAttacker-controlled values originating from converted CTI data were passed to multiple HTML-parsing sinks in the graph user interface without sufficient neutralisation. In particular, node labels, node sublabels, edge labels, node properties, edge properties, and node types could contain crafted HTML or JavaScript content.\\n\\nThe Pivotick graph library renders some of these values through HTML-parsing operations. Consequently, a malicious value such as an HTML element containing an event handler could be interpreted as markup rather than displayed as plain text. The first remediation explicitly notes that Pivotick rendered node and edge labels as HTML and therefore introduced escaping before data was handed to the graph renderer.\\n\\nA separate vulnerable sink was present in the Open raw JSON functionality. The raw object associated with a graph node was inserted into a new document using document.write() and an interpolated HTML string. Crafted JSON content could therefore break out of the intended \u003cpre\u003e element and inject executable markup. The fix replaced this construction with DOM APIs and assigns the JSON using textContent.\\n\\nThe initial correction did not cover all Pivotick rendering paths. A subsequent patch addressed additional XSS vectors in the graph properties panel. Values derived from the original CTI object\\u2014including property names, property values, hash algorithm names, child attributes, edge properties, and STIX object types\\u2014could still reach Pivotick\u0027s HTML resolver. According to the patch, Pivotick\u0027s tryResolveHTMLElement processes string values using template.innerHTML, allowing malicious markup to execute when a graph node is hovered over or selected.\\n\\nThe complete remediation therefore:\\n\\n * HTML-escapes node labels, node sublabels, and edge labels before they are passed to Pivotick.\\n * Restricts graph node type values to a safe identifier character set.\\n * Wraps node and edge property values in DOM elements populated through textContent, preventing Pivotick from treating attacker-controlled strings as HTML.\\n * Replaces the raw-JSON popup\u0027s interpolated document.write() with DOM construction and textContent.\", \"supportingMedia\": [{\"type\": \"text/html\", \"value\": \"\u003cp\u003eCTI-Transmute is affected by a stored cross-site scripting (XSS) vulnerability in the conversion graph used to visualise converted MISP and STIX content.\u003c/p\u003e\u003cp\u003eAttacker-controlled values originating from converted CTI data were passed to multiple HTML-parsing sinks in the graph user interface without sufficient neutralisation. In particular, node labels, node sublabels, edge labels, node properties, edge properties, and node types could contain crafted HTML or JavaScript content.\u003c/p\u003e\u003cp\u003eThe Pivotick graph library renders some of these values through HTML-parsing operations. Consequently, a malicious value such as an HTML element containing an event handler could be interpreted as markup rather than displayed as plain text. The first remediation explicitly notes that Pivotick rendered node and edge labels as HTML and therefore introduced escaping before data was handed to the graph renderer.\u003c/p\u003e\u003cp\u003eA separate vulnerable sink was present in the \u003cstrong\u003eOpen raw JSON\u003c/strong\u003e functionality. The raw object associated with a graph node was inserted into a new document using \u003ccode\u003edocument.write()\u003c/code\u003e and an interpolated HTML string. Crafted JSON content could therefore break out of the intended \u003ccode\u003e\u0026lt;pre\u0026gt;\u003c/code\u003e element and inject executable markup. The fix replaced this construction with DOM APIs and assigns the JSON using \u003ccode\u003etextContent\u003c/code\u003e.\u003c/p\u003e\u003cp\u003eThe initial correction did not cover all Pivotick rendering paths. A subsequent patch addressed additional XSS vectors in the graph properties panel. Values derived from the original CTI object\\u2014including property names, property values, hash algorithm names, child attributes, edge properties, and STIX object types\\u2014could still reach Pivotick\u0027s HTML resolver. According to the patch, Pivotick\u0027s \u003ccode\u003etryResolveHTMLElement\u003c/code\u003e processes string values using \u003ccode\u003etemplate.innerHTML\u003c/code\u003e, allowing malicious markup to execute when a graph node is hovered over or selected.\u003c/p\u003e\u003cp\u003eThe complete remediation therefore:\u003c/p\u003e\u003cul\u003e\u003cli\u003eHTML-escapes node labels, node sublabels, and edge labels before they are passed to Pivotick.\u003c/li\u003e\u003cli\u003eRestricts graph node \u003ccode\u003etype\u003c/code\u003e values to a safe identifier character set.\u003c/li\u003e\u003cli\u003eWraps node and edge property values in DOM elements populated through \u003ccode\u003etextContent\u003c/code\u003e, preventing Pivotick from treating attacker-controlled strings as HTML.\u003c/li\u003e\u003cli\u003eReplaces the raw-JSON popup\u0027s interpolated \u003ccode\u003edocument.write()\u003c/code\u003e with DOM construction and \u003ccode\u003etextContent\u003c/code\u003e.\u003c/li\u003e\u003c/ul\u003e\u003cp\u003e\u003c/p\u003e\", \"base64\": false}]}], \"problemTypes\": [{\"descriptions\": [{\"lang\": \"en\", \"type\": \"CWE\", \"cweId\": \"CWE-79\", \"description\": \"CWE-79 Improper Neutralization of Input During Web Page Generation (XSS or \u0027Cross-site Scripting\u0027)\"}]}], \"providerMetadata\": {\"orgId\": \"5a6e4751-2f3f-4070-9419-94fb35b644e8\", \"shortName\": \"CIRCL\", \"dateUpdated\": \"2026-08-10T13:58:57.154Z\"}}}",
"cveMetadata": "{\"cveId\": \"CVE-2026-72751\", \"state\": \"PUBLISHED\", \"dateUpdated\": \"2026-08-10T17:54:24.703Z\", \"dateReserved\": \"2026-08-10T13:58:29.653Z\", \"assignerOrgId\": \"5a6e4751-2f3f-4070-9419-94fb35b644e8\", \"datePublished\": \"2026-08-10T13:58:57.154Z\", \"assignerShortName\": \"CIRCL\"}",
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
}
}
Loading…
Loading…
Experimental. This forecast is provided for visualization only and may change without notice. Do not use it for operational decisions.
Forecast uses a logistic model when the trend is rising, or an exponential decay model when the trend is falling. Fitted via linearized least squares.
Sightings
| Author | Source | Type | Date | Other |
|---|
Nomenclature
- Seen: The vulnerability was mentioned, discussed, or observed by the user.
- Confirmed: The vulnerability has been validated from an analyst's perspective.
- Published Proof of Concept: A public proof of concept is available for this vulnerability.
- Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
- Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
- Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
- Not confirmed: The user expressed doubt about the validity of the vulnerability.
- Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.
Loading…
The MITRE ATT&CK techniques below are AI-generated suggestions, inferred from the description of the
vulnerability by the CIRCL/vulnerability-attack-technique-classification-roberta-base
model, served locally by ML-Gateway.
They have not been verified by an analyst and are provided for guidance only.
Loading…
Loading…