CVE-2026-73159

Popis

Affected versions of cti-transmute allow a tag-s icon value to be stored and later interpolated into HTML through Vue-s v-html. The helper mapIcon() previously constructed an HTML string directly from the icon value: <i class=-fas fa-${name}-></i> Because the icon is user-supplied, a crafted value could break out of the intended markup and inject attacker-controlled HTML. When the affected tag was later rendered, including on the administrative triage interface, the payload could execute in the viewer-s browser. The patch mitigates the issue at multiple layers: v-html is replaced with Vue :class binding, mapIcon() now returns only a constrained FontAwesome class string, and the backend validates icons against the FontAwesome catalogue or a strict [a-z0-9-]{1,40} slug pattern before storing them.