CVE-2026-71502: cti-transmute 0 through 1.4.0

Affected technology

cti-transmute · 0 through 1.4.0
misp

Component: Not specified by the source
Function: constructor

Attack conditions (Source advisory, CVSS 4.0): Network (remote) · No privileges required · Active user interaction

What an attacker can do

An unauthenticated attacker can create a public conversion whose name or description contains a malicious Vue expression using the application's configured [[ ... ]] delimiters. Source advisory’s CVSS 4.0 assessment (base score 5.1/10) rates confidentiality and integrity impact as low; availability impact as none.