MISP stores the galaxy icon value without performing server‑side validation, allowing an attacker to embed arbitrary HTML or JavaScript into the field. The value is later concatenated directly into the D3 correlation graph’s HTML markup, resulting in stored cross‑site scripting. A user with the perm_galaxy_editor permission—commonly assigned to the default User role—can inject malicious code, which will execute in any user’s browser that opens the correlation graph for an event containing that galaxy. This provides the attacker with the victim’s session context and the ability to steal credentials, manipulate data, or trigger actions on their behalf. The flaw affects both the default and the Overmind UI themes.

The vulnerability resides in the MISP platform. All installations running version 2.5.47 or earlier are affected. Version 2.5.48 and later have been patched to enforce strict input validation and mitigate the XSS flaw.

The CVSS score of 6.2 indicates a medium severity, and while an EPSS score is not available to gauge current exploitation likelihood, the vulnerability is a classic stored XSS that can be used to passively or actively compromise users who view the affected graph. Because the attacker only needs to create a galaxy with malicious content—an action permitted to users by default—the attack vector is easily exploitable in environments with permissive user roles. The vulnerability is not listed in the CISA KEV catalog, but the widely used MISP engagement means administrators should treat it as a high‑risk issue and apply the patch promptly.