CVE-2026-39980 - Vulnerability Analysis

Overview

OpenCTI < 6.9.5 contains a stored XSS caused by improper sanitization of EJS templates in safeEjs.ts, letting users with Manage customization capability execute arbitrary JavaScript in platform context, exploit requires Manage customization capability.

Severity & Score

Impact

Users with Manage customization capability can execute arbitrary JavaScript in the platform process, potentially leading to full system compromise.

Mitigation

Update to version 6.9.5 or later.

References

• https://github.com/OpenCTI-Platform/opencti/releases/tag/6.9.5
• https://github.com/OpenCTI-Platform/opencti/security/advisories/GHSA-jv9r-jw2f-rhrf

Social Media Activity(1 post)

TheHackerWire

@thehackerwire

Apr 12, 2026

🔴 CVE-2026-39980 - Critical (9.1) OpenCTI is an open source platform for managing cyber threat intelligence knowledge and observables. Prior to 6.9.5, the safeEjs.ts file does not properly sanitize EJS templates. Users with the Manage customization capability can run arbitrary Jav... 🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-39980/ #CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

View original post

Related Resources

• Vulnerability Intelligence Dashboard
• Credential Scanner