OpenCTI is an open source platform for managing cyber threat intelligence knowledge and observables.

Code

The project this record applies to. Exploit listings stay in References.

• Repository · github.com

Timeline

Detection, updates, and resolution for this record.

1. Apr 9, 2026 · NIST NVD

   Detected

   OpenCTI is an open source platform for managing cyber threat intelligence knowledge and observables. Prior to 6.9.5, the safeEjs.ts file does not properly sanitize EJS templates. Users with the Manage customization capability can run arbitrary JavaScript in the context of the OpenCTI platform process during notifier template execution. This vulnerability is fixed in 6.9.5.

2. Jun 17, 2026 · NIST NVD

   Updated

   OpenCTI is an open source platform for managing cyber threat intelligence knowledge and observables. Prior to 6.9.5, the safeEjs.ts file does not properly sanitize EJS templates. Users with the Manage customization capability can run arbitrary JavaScript in the context of the OpenCTI platform process during notifier template execution. This vulnerability is fixed in 6.9.5.

Affected

• cpe citeum/openctiversion unspecified

Sources

• CVE.orgVulnerability recordCVE-2026-39980

  Official CVE identifier

  cve.org
• NIST NVDVulnerability recordCVE-2026-39980

  OpenCTI is an open source platform for managing cyber threat intelligence knowledge and observables. Prior to 6.9.5, the safeEjs.ts file does not properly sanitize EJS templates. Users with the Manage customization capability can run arbitrary JavaScript in the context of the Ope

  nvd.nist.gov

References

• Product · github.com
• Vendor Advisory · github.com