by Kastro
Paper/Archive/CVE-2026-39980

CVE-2026-39980

OpenCTI-Platform opencti — OpenCTI affected by RCE via notifier template

EPSS 1%CVSS 9.1
critical.is priorityof 100
42
CVSS 9.1 (CNA)9.1 / 10 × 3027.3Not in CISA KEV+300.0EPSS percentile 71.6.716 × 2014.3No public exploit+100.0SSVC exploitation: none+100.0
Description · from the CVE record

OpenCTI is an open source platform for managing cyber threat intelligence knowledge and observables. Prior to 6.9.5, the safeEjs.ts file does not properly sanitize EJS templates. Users with the Manage customization capability can run arbitrary JavaScript in the context of the OpenCTI platform process during notifier template execution. This vulnerability is fixed in 6.9.5.

Affected

ProductAffectedFixed inSource
opencti< 6.9.5–CNA

Scores by source

GitHub_M (CNA)9.1CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H
CISA ADPSSVCExploitation: none · Automatable: no · Technical impact: total

References

refgithub.com/OpenCTI-Platform/opencti/security/advisories/GHSA-jv9r-jw2f-rhrfrefgithub.com/OpenCTI-Platform/opencti/releases/tag/6.9.5