In affected MISP deployments, users can configure dashboard widgets whose URLs are stored in the database without sufficient validation. Dangerous schemes such as javascript: or URLs with raw backslashes are not filtered, allowing an attacker to embed malicious code that executes when another user clicks the widget. The vulnerability is a classic stored XSS (CWE‑79) and also involves insufficient input sanitization (CWE‑20). The impact allows attackers to run arbitrary scripts in the victim’s browser or redirect to attacker controlled sites, potentially leading to credential theft or further compromise.

The flaw exists in all MISP releases up to and including 2.5.45. This includes the MISP MISP product distributed by the MISP organization. No other vendor product is listed.

The CVSS score of 5.1 indicates a moderate severity. EPSS data is not available, so the baseline exploitation likelihood is unclear, and the vulnerability is not listed in CISA’s KEV catalog. Attackers can exploit it via a user‑controlled widget configuration; any user with access to create or edit dashboard widgets can supply a malicious URL, so the initial attack vector is a trusted user or compromised account. Once injected, the malicious script runs in the context of any user who interacts with the widget, giving the attacker broad in‑application access.