CVE-2026-39980
Arbitrary JavaScript execution on OpenCTI through crafted notifier templates
OpenCTI before 6.9.5 fails to sanitize EJS templates used for notifier messages; EJS is a JavaScript template engine. A user with the Manage customization capability can run arbitrary JavaScript in the context of the OpenCTI platform process. The issue is fixed in 6.9.5 and is not on CISA's known-exploited list.
OpenCTI-Platform opencti · Updated 28 Oct · From the public records
Being exploitedNot reportedNo attacks reported in the records
CISA known exploitedNot listedThe US list of flaws under attack
SeveritycriticalCVSS 9.1 of 10
FixNot yetSee what to do below
Am I affected?
The records do not list fixed versions yet. Check the vendor's advisory below.
What to do
- Upgrade OpenCTI to 6.9.5, which fixes this vulnerability.
- Restrict the Manage customization capability to trusted administrators only.
- Review notifier templates for any suspicious or unauthorized JavaScript.
- Monitor OpenCTI logs for signs of unexpected code execution.
What happened
- 23 OctRapid7 publishes a Metasploit Wrap Up mentioning Langflow, MongoDB, and more.
The record
| CVE | What it is | Severity | CISA listed | Exploit chance, 30 days |
|---|---|---|---|---|
| CVE-2026-39980 | OpenCTI affected by RCE via notifier template | critical 9.1 | No | 1.4% |
Our reporting
We have not reported on it. It is here because the sources below did.
Reported elsewhere
Rapid7 · 23 OctMetasploit Wrap Up: Langflow, MongoDB, and More ↗The records
CVE-2026-39980 on NVD ↗Is anything you run affected?Members connect Zotpaper to their AI assistant. It checks your own project against every vulnerability on this page and the others we track, and says what to update.
How it works