CVE-2026-71502

*** Pendiente de traducción *** CTI-Transmute contains a stored cross-site scripting vulnerability caused by insufficient neutralization of Vue template expression delimiters in server-rendered user-controlled data.<br /> <br /> An unauthenticated attacker can create a public conversion whose name or description contains a malicious Vue expression using the application&amp;#39;s configured [[ ... ]] delimiters. User profile names may provide an additional injection vector. Although Jinja HTML escaping is applied, the resulting value is subsequently included in a DOM region compiled by Vue.<br /> <br /> Vue interprets the attacker-controlled value as a template expression rather than ordinary text. By accessing the JavaScript Function constructor from within the expression, an attacker can execute arbitrary JavaScript in the security context of the CTI-Transmute origin. The application&amp;#39;s nonce-based Content Security Policy does not prevent exploitation because the Vue runtime compiler requires the unsafe-eval policy exception.<br /> <br /> The malicious payload is stored by the application and executed whenever another user opens an affected page, such as the public conversion detail page. The victim may be a normal user or an administrator. Successful exploitation could allow the attacker to:<br /> <br /> * Access data available to the victim through the application.<br /> * Extract API keys, tokens, or other sensitive information exposed to the page.<br /> * Perform authenticated actions using the victim&amp;#39;s session.<br /> * Modify conversions or other application data.<br /> * Escalate the impact by targeting an administrator.<br /> <br /> <br /> A demonstrated payload can use [].constructor.constructor(...) to obtain the JavaScript Function constructor and execute arbitrary code. The regression tests also show that a short first-stage payload could retrieve an uncapped conversion description and evaluate a larger second-stage payload.<br /> <br /> The patch addresses the vulnerability by registering a global Jinja finalize hook that inserts a zero-width Unicode word joiner inside every Vue delimiter found in server-rendered values. This prevents Vue from recognizing the values as template expressions while preserving their visible representation.