Description
MISP contains a stored cross-site scripting (XSS) vulnerability in the index table rendering of the remote event preview. The count field template escaped the associated link URL but rendered the field value without HTML encoding. An attacker with the ability to create or modify events on a linked (remote) MISP server could craft an event identifier containing HTML or JavaScript markup. When a user on the local MISP instance views the remote event preview index, the unescaped value is rendered directly in the browser, allowing arbitrary script execution in the victim's session.

Preconditions:

- A linked/remote MISP server is configured and connected to the local instance.

- The attacker has sufficient access on the linked server to create or modify an event with a crafted identifier.

- A victim user on the local instance views the remote event preview index page.

Impact:

- Execution of arbitrary JavaScript in the context of the MISP web application.

- Potential session hijacking, data exfiltration, or unauthorized actions performed on behalf of the authenticated user.

Affected versions: <2.5.48.
Published: 2026-10-02
Score: 5.3 Medium
EPSS: n/a
KEV: No
Impact: Stored cross‑site scripting
Action: Patch Now
AI Analysis

Impact

The vulnerability is a stored cross‑site scripting flaw in the remote event preview index of MISP. The count field value is rendered without HTML encoding, allowing an attacker who can create or modify events on a linked server to embed script or markup. When a local user views the preview, the unescaped value is executed in the browser, leading to arbitrary JavaScript execution in the victim’s session.

Affected Systems

Affected vendors and products are MISP from the MISP project. Versions before 2.5.48 are vulnerable. The flaw occurs only when a linked or remote MISP server is configured and the local instance renders the remote event preview index.

Risk and Exploitability

The CVSS score of 5.3 marks the flaw as moderate but not critical. No EPSS score is available, and the vulnerability is not listed in CISA KEV. Exploitation requires the attacker to have sufficient privileges on the remote MISP server to inject a crafted event identifier, and requires a victim user to visit the remote event preview index. If those conditions are met, the attacker can run arbitrary scripts, hijack sessions, or perform other actions within the victim’s authenticated session.

Generated by OpenCVE AI on October 2, 2026 at 16:21 UTC.

Remediation

Vendor Solution

The vulnerability is remediated by applying HTML entity encoding to the count field value before it is rendered in the view template. This ensures that any HTML or script markup contained in the value from a remote server is neutralized and displayed as inert text rather than being interpreted by the browser.

OpenCVE Recommended Actions

  • Apply the vendor’s patch that encodes the count field value before rendering in the view template.
  • Restrict write permissions on linked MISP servers to prevent creation or modification of events that can contain malicious identifiers.
  • Disable or restrict access to the remote event preview index for users who do not need it.

Generated by OpenCVE AI on October 2, 2026 at 16:21 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Fri, 02 Oct 2026 15:30:00 +0000

Type Values Removed Values Added
Description MISP contains a stored cross-site scripting (XSS) vulnerability in the index table rendering of the remote event preview. The count field template escaped the associated link URL but rendered the field value without HTML encoding. An attacker with the ability to create or modify events on a linked (remote) MISP server could craft an event identifier containing HTML or JavaScript markup. When a user on the local MISP instance views the remote event preview index, the unescaped value is rendered directly in the browser, allowing arbitrary script execution in the victim's session. Preconditions: - A linked/remote MISP server is configured and connected to the local instance. - The attacker has sufficient access on the linked server to create or modify an event with a crafted identifier. - A victim user on the local instance views the remote event preview index page. Impact: - Execution of arbitrary JavaScript in the context of the MISP web application. - Potential session hijacking, data exfiltration, or unauthorized actions performed on behalf of the authenticated user. Affected versions: <2.5.48.
Title MISP Stored XSS via Unescaped Count Field Value in Remote Event Preview Index
First Time appeared Misp
Misp misp
Weaknesses CWE-79
CPEs cpe:2.3:a:misp:misp:*:*:*:*:*:*:*:*
Vendors & Products Misp
Misp misp
References
Metrics cvssV4_0

{'score': 5.3, 'vector': 'CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N'}

Subscriptions

Misp Misp
cve-icon MITRE

Status: PUBLISHED

Assigner: CIRCL

Published:

Updated: 2026-10-02T16:15:09.284Z

Reserved: 2026-10-02T15:16:25.316Z

Link: CVE-2026-104900

cve-icon Vulnrichment

No data.

cve-icon NVD

Status : Deferred

Published: 2026-10-02T16:16:47.573

Modified: 2026-10-02T16:16:47.683

Link: CVE-2026-104900

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2026-10-02T16:30:14Z

Weaknesses
  • CWE-79

    Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')