MISP contains a reflected Cross-Site Scripting (XSS) vulnerability in the event attribute filtering query builder. The taggedAttributes and galaxyAttachedAttributes URL parameters were inserted into the query-builder rules without HTML escaping before being serialized as JSON and embedded inside a <script> element.
Because JsonTool::encode() uses JSON_UNESCAPED_SLASHES, an attacker-controlled value containing a closing </script> sequence could terminate the surrounding script element and inject arbitrary HTML or JavaScript. For example, a specially crafted viewEventAttributes URL could contain malicious content in one of the affected filter parameters.
An attacker could exploit the vulnerability by convincing an authenticated MISP user to follow a crafted URL. Successful exploitation would execute attacker-controlled JavaScript in the security context of the MISP instance and with the privileges of the victim's authenticated browser session. This could allow access to information available to the victim, modification of data through authenticated requests, or other actions permitted by the victim's MISP permissions.
The vulnerability is addressed by applying HTML escaping with h() to both scalar and array values before they are inserted into the DOM.
References
| Link | Resource |
|---|---|
| https://github.com/MISP/MISP/commit/de51a16db | Patch |
Configurations
History
No history.
Information
Published : 2026-09-03 15:17
Updated : 2026-09-10 19:38
NVD link : CVE-2026-85227
Mitre link : CVE-2026-85227
CVE.ORG link : CVE-2026-85227
JSON object : View
Products Affected
misp-project
- misp
CWE
CWE-79
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')