A persistent injection flaw in the MISP dashboard ButtonWidget allows an authenticated user who can modify widget settings to store arbitrary URL values, including javascript: links. The stored values are validated only when the widget renders, leaving a persistence‑layer validation gap. If the malicious URL is later rendered or navigated to without additional checks, client‑side script could execute in the security context of the affected user, enabling the attacker to perform actions with that user's privileges or access session data.

The vulnerability affects the MISP platform (mispn:mis). No specific version range is listed in the available data, so all installations that have the ButtonWidget and allow authenticated dashboard configuration changes are potentially impacted.

The CVSS score of 5.3 indicates moderate severity, and the vulnerability is not listed in CISA KEV. Practical exploitation is limited because MISP performs URL validation at render time, which neutralizes many known malicious values before they reach the user. Nevertheless, an attacker with the ability to persist a javascript: URL could still exploit the weakness if the rendering validation does not catch it. The attack vector requires authentication and permission to modify dashboard widgets, so the threat is confined to legitimate users with configuration rights.