The vulnerability originates from the MISP event attribute filtering query builder where the parameters taggedAttributes and galaxyAttachedAttributes are inserted into a JavaScript context without HTML escaping. When the JsonTool::encode() function renders these values with JSON_UNESCAPED_SLASHES, an attacker can embed a closing </script> sequence in the URL parameters. This terminates the surrounding script tag, allowing arbitrary HTML or JavaScript to be injected and executed in the victim browser. The flaw is a classic reflected Cross‑Site Scripting vulnerability in which malicious code runs in the security context of an authenticated MISP user. Consequently, the attacker can read or modify data that the victim is authorized to see or do.

All MISP installations that use the event attribute filtering query builder are affected. The CVE does not list specific vulnerable versions, so any pre‑patch instance that processes taggedAttributes or galaxyAttachedAttributes in the described manner is vulnerable.

The CVSS score is 6.1 (moderate). EPSS is not available, indicating no public information on exploitation probability. The vulnerability is not listed in CISA KEV. Exploitation requires an authenticated user to click a crafted URL; the attacker’s script then runs in the victim’s browser session with the same permissions, allowing data reading or authorized modifications. The attack vector is web application–based and relies on user interaction, making it exploitable in environments lacking script restrictions or robust CSP.