A stored cross‑site scripting flaw exists in MISP’s event graph preview. An authenticated user can create or modify a graph entry with a malicious image value that is stored without server‑side validation. When another user opens the preview, the value is injected into an img tag’s src attribute via string concatenation, allowing the attacker’s script to execute in the victim’s browser.

The vulnerability affects all MISP installations that use a version older than the commit that applies the fix (prior to v2.5.48). The software in question is the open‑source MISP platform, managed by the MISP organization. Only installations that allow user‑generated graph entries are impacted.

The CVSS score of 8.3 reflects a high‑severity client‑side attack that can lead to session hijacking or privilege escalation. EPSS data is unavailable, so the exploitation probability is unknown, and the flaw is not yet listed in the CISA KEV catalog. The attack requires an authenticated attacker to inject the payload and a second party to view the preview, making it a considerable threat for environments where privileged users access MISP.