What is CVE-2026-73159?
This vulnerability exists in the 'cti-transmute' component where user-supplied icon values are interpolated into HTML via Vue's v-html directive without proper sanitization. This can lead to XSS attacks. Developers should use safe binding methods instead of directly constructing HTML strings in the mapIcon() function.
Azərbaycanca: Bu boşluq 'cti-transmute' komponentində aşkarlanıb, burada istifadəçi tərəfindən təqdim olunan ikon dəyəri HTML-ə Vue'nin v-html direktivi ilə düzgün təmizlənmədən interpolasiya edilir. Bu, XSS hücumlarına səbəb ola bilər. Tərtibatçılar mapIcon() funksiyasında birbaşa HTML string yığmaq əvəzinə təhlükəsiz bağlama metodlarından istifadə etməlidir.
Related CVEs
link basis: same weakness class CWE-79
FAQ2
In which component and for what reason does CVE-2026-73159 vulnerability occur?
The vulnerability exists in the 'cti-transmute' component because user-supplied icon values are interpolated into HTML via Vue's v-html directive without proper sanitization.
What should developers do to mitigate the CVE-2026-73159 XSS vulnerability?
Developers should use safe binding methods instead of directly constructing HTML strings in the mapIcon() function.
See also6
This explainer is AI-written from source data — skopnix's own reporting on this CVE; CVSS scores, vendors and versions are never invented. See NVD for the official record.