The vulnerability is a reflected cross‑site scripting flaw in the UiBeta event index view of MISP. A malicious URL contains a crafted searcheventinfo parameter that is inserted into an inline JavaScript handler using HTML escaping inside a single‑quoted string. Because browsers decode HTML entities before parsing JavaScript, an attacker can inject quote characters that break out of the string, allowing arbitrary JavaScript execution in the victim’s browser context. This flaw is classified as CWE‑79 and can be exploited to steal credentials, deface, or perform actions on behalf of the authenticated user.

MISP (misp:misp) is affected. No specific version information is disclosed in the advisory; users should check the vendor’s release notes for the presence of the described fix.

The CVSS score of 5.3 indicates a medium severity. The EPSS score is not reported, and the vulnerability is not listed in CISA’s Known Exploited Vulnerabilities catalog, suggesting that widespread exploitation has not yet occurred. The likely attack vector is a web‑based HTTP request containing a malicious URL. An attacker who convinces a user to visit a crafted link while logged into MISP can inject and execute JavaScript in that user’s browser, potentially compromising session data and the integrity of the application.