A stored cross‑site scripting flaw exists in MISP BSimVis tag rendering logic. Tag names, collection names, entity identifiers, cluster names, and tag metadata are incorporated directly into HTML, HTML attributes, inline JavaScript events, and CSS style values without proper escaping, allowing an attacker to originate an HTML/JavaScript payload that is stored and later displayed to other users. If the payload is executed in a victim’s browser, the attacker can run arbitrary JavaScript within the victim’s session, enabling credential theft, session hijacking, data exfiltration, or manipulation of visible application content.

The vulnerability affects the MISP BSimVis component, with affected versions up to and including v0.2.0. Any instance of the library prior to the patch that processes tag metadata in the rendering paths is impacted.

The reported CVSS score of 6.9 indicates a moderate severity. EPSS is unavailable, so the likelihood of exploitation is not quantified, and the flaw is not listed in the CISA KEV catalog. Exploitation requires an authenticated user with the ability to create or modify tag or metadata values, after which the injected content is stored and rendered to other users who view the affected BSimVis pages. The attack vector is therefore indirect and relies on user input that is not sanitized before storage.