PT-2026-44211 · Git+1 · Cti-Transmute

Ecrou-Exact 🔩 · Published 2026-05-28 · Updated 2026-05-28 · CVE-2026-9806

Positive Technologies (AI Summary)

CVSS v4.0

6.3

Medium

Base vector

AV:N/AC:L/AT:P/PR:N/UI:N/VC:L/VI:N/VA:N/SC:L/SI:N/SA:N/S:N/RE:L/U:Clear

Name of the Vulnerable Software and Affected Versions CTI Transmute (affected versions not specified)

Description A stored cross-site scripting (XSS) issue exists in the notification panel. Notification messages containing user-controlled convert names were rendered in the notification bell dropdown using innerHTML without adequate sanitization. An attacker who can influence a convert name included in a notification can inject arbitrary JavaScript. This script executes in the browser of an authenticated user upon opening the notification panel, potentially allowing the attacker to perform actions in the victim's session or access application information. This issue was limited to a development branch.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploit

XSS

Weakness Enumeration

CWE-79

Related Identifiers

CVE-2026-9806

Affected Products

Cti-Transmute

References · 4

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/9xxx/CVE-2026-9806.json · Exploit
• https://github.com/MISP/cti-transmute/commit/cf42409badc27b13d9bb644b9175aa7f27e11259 · Patch
• https://osv.dev/vulnerability/CVE-2026-9806 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2026-9806 · Security Note