CVE-2026-73161
CVE-2026-73161 updated by NVD
Summary
Affected versions of cti-transmute improperly handle conversion-table values passed through the search highlighting feature. The highlight() function previously returned the underlying text directly when no search query was supplied, or performed a regex replacement that inserted tags without first escaping the original content. Because the resulting value is used by an HTML-rendering sink, malicious markup contained in conversion data could be interpreted as HTML rather than displayed as text. The fix introduces a shared highlightMatches() helper that first converts special characters such as , &, and quotes into HTML entities. Only after escaping does the code insert the application-controlled element used for search highlighting.
References
Includes data from the ENISA EU Vulnerability Database (EUVD).
Includes data from the National Vulnerability Database (NIST). NVD data is in the public domain; this page is not endorsed by NIST.
CVE® is a registered trademark of The MITRE Corporation. CVE content reproduced under the CVE Terms of Use; copyright designation © MITRE.