Affected versions of cti-transmute insufficiently validate saved graph configuration data. Graph configurations can contain style properties that are later consumed by Pivotick, and Pivotick interpre…

摘要

Affected versions of cti-transmute insufficiently validate saved graph configuration data. Graph configurations can contain style properties that are later consumed by Pivotick, and Pivotick interprets svgIcon as HTML. Because saved configurations may be created by one user and later displayed to other users—including administrators—a malicious user could store a crafted svgIcon value that executes script in another viewer’s browser. The fix introduces a strict configuration schema on both th…

中文摘要建设中，暂以英文摘要呈现（DR-003 v2）。