Description
MISP contains a CSS injection vulnerability in the remote event preview feature. When a user previews an event from a linked MISP server, the colour value associated with each remote tag is written directly into an inline CSS style attribute without sufficient validation. Although HTML entity encoding is applied, the value is interpreted as CSS within the style attribute, allowing a malicious or compromised linked server to inject arbitrary CSS declarations.

An attacker with the ability to create or modify tags on a linked MISP instance can craft a tag colour value containing CSS injection payloads. When a user on the local instance views the event preview, the injected CSS is rendered, potentially allowing UI manipulation, visual spoofing, or limited information disclosure through CSS-based techniques.

Preconditions:

- A linked MISP server relationship exists between the victim instance and the attacker-controlled instance.

- The attacker can create or modify tags on the linked server.

- A victim user views the remote event preview page.

Affected: <2.5.48.
Published: 2026-10-19
Score: 4.8 Medium
EPSS: n/a
KEV: No
Impact: CSS Injection via Remote Tag Colour
Action: Apply Patch
AI Analysis

Impact

MISP allows a malicious linked server to inject arbitrary CSS into the event preview page through the colour field of remote tags. The colour value is placed directly inside an inline style attribute without proper validation, enabling UI manipulation, visual spoofing, or limited information disclosure via CSS techniques. This flaw does not grant code execution but can influence user perception and potentially hide or reveal content.

Affected Systems

The vulnerability exists in MISP for all releases prior to version 2.5.48. Any environment that maintains linked MISP server relationships exposes the affected local instance to this risk.

Risk and Exploitability

The CVSS score of 4.8 indicates a moderate impact; the EPSS score is not available, and the flaw is not listed in the CISA KEV catalog. Exploitation requires an attacker to have the capability to create or modify tags on a linked MISP server and a victim user to view the remote event preview. The attack vector is remote but relies on an existing link relationship and user interaction.

Generated by OpenCVE AI on October 19, 2026 at 10:28 UTC.

Remediation

Vendor Solution

The fix introduces strict validation of the tag colour value before it is rendered into a CSS style attribute. Only values matching a valid six-digit hexadecimal colour pattern (e.g. #aabbcc) are accepted; any other value is replaced with a safe default (#ffffff). This prevents arbitrary CSS from being injected through the colour field, aligning the remote tag handling with the validation already applied to local tags.

OpenCVE Recommended Actions

  • Upgrade MISP to version 2.5.48 or later, which implements strict validation of tag colour values and replaces invalid inputs with a safe default.
  • Verify that the colour field accepts only six‑digit hexadecimal values (e.g., #aabbcc) and rejects all other input.
  • If an immediate upgrade is not possible, temporarily disable remote event preview or restrict linked server access until a patch can be installed.

Generated by OpenCVE AI on October 19, 2026 at 10:28 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Mon, 19 Oct 2026 09:45:00 +0000

Type Values Removed Values Added
Description MISP contains a CSS injection vulnerability in the remote event preview feature. When a user previews an event from a linked MISP server, the colour value associated with each remote tag is written directly into an inline CSS style attribute without sufficient validation. Although HTML entity encoding is applied, the value is interpreted as CSS within the style attribute, allowing a malicious or compromised linked server to inject arbitrary CSS declarations. An attacker with the ability to create or modify tags on a linked MISP instance can craft a tag colour value containing CSS injection payloads. When a user on the local instance views the event preview, the injected CSS is rendered, potentially allowing UI manipulation, visual spoofing, or limited information disclosure through CSS-based techniques. Preconditions: - A linked MISP server relationship exists between the victim instance and the attacker-controlled instance. - The attacker can create or modify tags on the linked server. - A victim user views the remote event preview page. Affected: <2.5.48.
Title MISP CSS Injection via Remote Tag Colour in Event Preview
First Time appeared Misp
Misp misp
Weaknesses CWE-74
CPEs cpe:2.3:a:misp:misp:*:*:*:*:*:*:*:*
Vendors & Products Misp
Misp misp
References
Metrics cvssV4_0

{'score': 4.8, 'vector': 'CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:A/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N'}

Subscriptions

Misp Misp
cve-icon MITRE

Status: PUBLISHED

Assigner: CIRCL

Published:

Updated: 2026-10-19T09:15:47.453Z

Reserved: 2026-10-19T09:15:45.556Z

Link: CVE-2026-112183

cve-icon Vulnrichment

No data.

cve-icon NVD

Status : Deferred

Published: 2026-10-19T10:16:46.970

Modified: 2026-10-19T10:16:47.080

Link: CVE-2026-112183

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2026-10-19T10:30:13Z

Weaknesses
  • CWE-74

    Improper Neutralization of Special Elements in Output Used by a Downstream Component ('Injection')