OpenCTI JSON Mapper safeEjs Sandbox Escape RCE

OpenCTI is an open source cyber threat intelligence platform built as a Node.js GraphQL application. Its data-mapping feature lets a user attach an EJS "formula" to a JSON mapper attribute, which the backend renders through a home-grown sandbox safeEjs that is intended to allow only arithmetic an...

CVE-2026-39980

OpenCTI is an open source platform for managing cyber threat intelligence knowledge and observables. Prior to 6.9.5, the safeEjs.ts file does not properly sanitize EJS templates. Users with the Manage customization capability can run arbitrary JavaScript in the context of the OpenCTI platform...

CVE-2026-39980

OpenCTI is an open source platform for managing cyber threat intelligence knowledge and observables. Prior to 6.9.5, the safeEjs.ts file does not properly sanitize EJS templates. Users with the Manage customization capability can run arbitrary JavaScript in the context of the OpenCTI platform...

CVE-2026-39980 OpenCTI affected by RCE via notifier template

OpenCTI is an open source platform for managing cyber threat intelligence knowledge and observables. Prior to 6.9.5, the safeEjs.ts file does not properly sanitize EJS templates. Users with the Manage customization capability can run arbitrary JavaScript in the context of the OpenCTI platform...

OpenCTI security vulnerabilities

OpenCTI is an open-source network threat intelligence platform developed by OpenCTI. Versions of OpenCTI prior to 6.9.5 contained security vulnerabilities. These vulnerabilities stemmed from the improper cleanup of EJS templates in the safeEjs.ts file, allowing users with administrative privilege...