Description
MISP renders the source field of a Galaxy Cluster as a clickable hyperlink whenever the stored value passes PHP's FILTER_VALIDATE_URL validation. Because FILTER_VALIDATE_URL accepts the javascript: URI scheme, a user with galaxy editor privileges on the local instance or on a synced instance could store a javascript: URL as the cluster source.

When another user views the affected Galaxy Cluster and clicks the rendered link, the embedded script executes in the victim's browser context, enabling session hijacking, data exfiltration, or actions performed on behalf of the victim.

Preconditions:

- Attacker must hold galaxy editor privileges (local or via sync).

- Victim must view the affected cluster and click the malicious link.

Impact:

- Stored cross-site scripting (XSS) in the victim's browser.

- Potential session theft, credential harvesting, or unauthorized actions within the MISP application.

Affected: <2.5.48.
Published: 2026-09-30
Score: 6.2 Medium
EPSS: < 1% Very Low
KEV: No
Impact: Stored cross-site scripting
Action: Apply patch
AI Analysis

Impact

MISP renders the source field of a Galaxy Cluster as a clickable hyperlink when the stored value passes PHP's FILTER_VALIDATE_URL validation. Because that function accepts the javascript: URI scheme, a user with galaxy editor privileges can store a javascript: URL in the cluster source. When another user views the cluster and clicks the rendered link, the embedded script runs in the victim's browser context, providing session hijacking, credential theft, or arbitrary actions within the MISP application.

Affected Systems

The vulnerability affects MISP instances running versions earlier than 2.5.48. The issue is present across both the default theme and the Overmind theme, regardless of theme selections.

Risk and Exploitability

The CVSS score of 6.2 indicates a moderate severity. EPSS data is not available, and the vulnerability is not listed in the CISA KEV catalog. Exploitation requires the attacker to possess galaxy editor privileges on the local or a synced instance and the victim must view and click the malicious link. Under these conditions the stored XSS can be used to steal session tokens or execute unauthorized actions.

Generated by OpenCVE AI on September 30, 2026 at 16:21 UTC.

Remediation

Vendor Solution

The fix restricts the rendering of the Galaxy Cluster source field as a hyperlink to only http:// and https:// URLs by adding a regular-expression check (preg_match for ^https?://) in addition to the existing FILTER_VALIDATE_URL validation. This prevents javascript: and other non-HTTP URI schemes from being rendered as clickable links, eliminating the stored XSS vector. The change is applied consistently in both the default theme and the Overmind theme.

OpenCVE Recommended Actions

  • Apply the MISP update that includes the regex check to restrict hyperlink URLs to http:// and https:// schemes (v2.5.48 or later).
  • Review and enforce that the Galaxy Cluster source field only accepts http and https URLs, ensuring the validation logic includes the regular-expression check for ^https?://.
  • If an immediate patch is not possible, disable hyperlink rendering for the Galaxy Cluster source field or remove galaxy editor privileges for untrusted users.

Generated by OpenCVE AI on September 30, 2026 at 16:21 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Wed, 30 Sep 2026 14:45:00 +0000

Type Values Removed Values Added
Description MISP renders the source field of a Galaxy Cluster as a clickable hyperlink whenever the stored value passes PHP's FILTER_VALIDATE_URL validation. Because FILTER_VALIDATE_URL accepts the javascript: URI scheme, a user with galaxy editor privileges on the local instance or on a synced instance could store a javascript: URL as the cluster source. When another user views the affected Galaxy Cluster and clicks the rendered link, the embedded script executes in the victim's browser context, enabling session hijacking, data exfiltration, or actions performed on behalf of the victim. Preconditions: - Attacker must hold galaxy editor privileges (local or via sync). - Victim must view the affected cluster and click the malicious link. Impact: - Stored cross-site scripting (XSS) in the victim's browser. - Potential session theft, credential harvesting, or unauthorized actions within the MISP application. Affected: <2.5.48.
Title MISP Stored Cross-Site Scripting via JavaScript URL in Galaxy Cluster Source Field
First Time appeared Misp
Misp misp
Weaknesses CWE-79
CPEs cpe:2.3:a:misp:misp:*:*:*:*:*:*:*:*
Vendors & Products Misp
Misp misp
References
Metrics cvssV4_0

{'score': 6.2, 'vector': 'CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:A/VC:N/VI:N/VA:N/SC:H/SI:H/SA:N'}

Subscriptions

Misp Misp
cve-icon MITRE

Status: PUBLISHED

Assigner: CIRCL

Published:

Updated: 2026-09-30T15:28:06.980Z

Reserved: 2026-09-30T14:22:32.098Z

Link: CVE-2026-103388

cve-icon Vulnrichment

No data.

cve-icon NVD

Status : Deferred

Published: 2026-09-30T15:22:27.143

Modified: 2026-09-30T16:17:08.983

Link: CVE-2026-103388

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2026-09-30T19:45:14Z

Weaknesses
  • CWE-79

    Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')