aj2108/cve-2026-9806CVE-2026-9806 is a Stored Cross-Site Scripting (Stored XSS) vulnerability affecting CTI Transmute versions prior to the patched release.
CVE-2026-9806 is a Stored Cross-Site Scripting (Stored XSS) vulnerability affecting CTI Transmute versions prior to the patched release.The flaw exists in the notification panel, where notification messages containing user-controlled convert names are rendered in the notification bell dropdown using innerHTML without proper sanitization. If an attacker can create or influence a convert name that appears in a notification, arbitrary JavaScript can execute in the browser of an authenticated user when they open the notification panel.
The notification panel constructs notification entries using innerHTML. Notification messages include convert names, which are user-controlled. Because these values are inserted directly into the DOM without HTML encoding or sanitization, any HTML or JavaScript contained within a convert name is interpreted by the browser.
Conceptually:
Attacker creates or influences a convert name
│
▼
Convert name stored in notification
│
▼
User opens notification panel
│
▼
Notification rendered using innerHTML
│
▼
Browser parses HTML
│
▼
Embedded JavaScript executes
The vulnerability is caused by rendering untrusted input as HTML rather than as plain text.
Attacker
│
▼
Creates or modifies a malicious convert name
│
▼
Notification containing the convert name is generated
│
▼
Victim opens notification panel
│
▼
Notification dropdown inserts message using innerHTML
│
▼
Browser executes malicious JavaScript
│
▼
Actions performed within victim's authenticated session
Suppose a convert is created with a specially crafted name containing HTML.
Later, another authenticated user receives a notification referencing that convert. When the user clicks the notification bell, the application inserts the notification message into the page using innerHTML.
Instead of displaying the convert name as text, the browser interprets it as HTML and executes the embedded JavaScript, allowing the attacker to perform actions within the victim's browser session.
A legitimate user creates a convert named:
Monthly Sales Report
The application stores it in the database.
An attacker instead enters a name containing HTML:
Quarterly Report <b>Important</b>
The application stores:
Quarterly Report <b>Important</b>
Later, another user receives a notification such as:
Convert "Quarterly Report <b>Important</b>" completed successfully.
If the application does:
notification.innerHTML = response.message;
the browser renders:
Convert Quarterly Report Important completed successfully.
because is interpreted as HTML.
If the application instead uses:
notification.textContent = response.message;
the browser displays the literal text:
Convert "Quarterly Report <b>Important</b>" completed successfully.
No HTML is interpreted.
Successful exploitation may allow an attacker to:
| Metric | Score |
|---|
| CVSS v4.0 (CNA) | 6.3 (Medium) |
NVD has not yet assigned its own CVSS assessment.
Note: The vendor has not published the exact vulnerable source code. The following demonstrates the vulnerable pattern.
// User-controlled convert name
const message = response.notificationMessage;
// Unsafe rendering
notificationDropdown.innerHTML += `
<div class="notification">
${message}
</div>
`;
innerHTML treats the notification message as HTML. If the message contains HTML or JavaScript originating from a malicious convert name, the browser parses and executes it.
const notification = document.createElement("div");
notification.className = "notification";
// Safe rendering
notification.textContent = response.notificationMessage;
notificationDropdown.appendChild(notification);
Using textContent ensures the notification message is rendered as plain text instead of HTML. As noted in the published remediation, the issue was fixed by constructing notification elements through DOM methods and assigning content via textContent rather than innerHTML, preventing execution of embedded scripts.