Description
MISP contains an HTML injection vulnerability in the MISPElementHTMLFormatterTool component, which is responsible for rendering MISP element references (attributes, objects, and tags) into inline HTML during PDF report export via the convert_markdown_to_pdf module. The attribute(), objectAttribute(), object(), and tag() methods interpolated user-controlled fields (attribute type, attribute value, object name, object relation, tag name, tag colour, and tag text colour) directly into HTML templates without applying HTML entity encoding. An authenticated user with the ability to create or modify MISP attributes, objects, or tags could embed arbitrary HTML markup in these fields. When a report containing such elements was exported to PDF, the unescaped content was rendered as live HTML rather than inert text, potentially injecting script tags, breaking the document structure, or altering the visual content of the exported report. Additionally, the attribute() method contained a template with hardcoded sample values ("domain-ip" and "google.com") instead of format placeholders, meaning every plain attribute reference in a PDF displayed the sample text rather than the actual indicator value, constituting a data-integrity defect in the exported document. The vulnerability requires an authenticated actor with write access to MISP elements and a subsequent PDF export of a report referencing those elements. The security impact is primarily to the integrity of the exported document and, depending on the HTML-to-PDF rendering engine, potential execution of injected markup during the conversion step.

Version affected: ≤2.5.45
Published: 2026-09-10
Score: 5.1 Medium
EPSS: n/a
KEV: No
Impact: Integrity of exported PDF reports and potential script execution via HTML injection
Action: Patch
AI Analysis

Impact

The vulnerability allows an authenticated user with write access to MISP attributes, objects, or tags to embed arbitrary HTML markup into fields that are rendered into PDF reports. The unescaped content is interpreted as live HTML during the PDF conversion, potentially injecting scripts, breaking the document structure, or altering visual appearance. Because the HTML is processed by the rendering engine, the impact focuses on the integrity of the report and could lead to malicious payload execution in the conversion step.

Affected Systems

All installations of MISP version 2.5.45 and earlier are affected. The flaw resides in the MISPElementHTMLFormatterTool component used by the convert_markdown_to_pdf module.

Risk and Exploitability

The CVSS base score of 5.1 indicates a medium risk. The EPSS score is not available, and the KEV catalog does not list this vulnerability, suggesting no known widespread exploitation. However, authentication is required and the attacker must be able to create or modify MISP elements and then trigger a PDF export. As the flaw involves user‑controlled input and HTML rendering, it is potentially exploitable without advanced privileges beyond normal MISP write access.

Generated by OpenCVE AI on September 10, 2026 at 14:36 UTC.

Remediation

Vendor Solution

The fix applies HTML entity encoding (via the h() helper, which wraps htmlspecialchars with ENT_QUOTES and UTF-8) to every user-controlled value interpolated into the HTML templates in the MISPElementHTMLFormatterTool. This ensures that attribute types, values, object names, relations, tag names, and colour values are treated as inert data and cannot inject markup or break out of the surrounding span/style context. The hardcoded sample values in the attribute() template are replaced with proper %s format placeholders so that the actual element data is rendered. Comprehensive unit tests are added to verify both correct rendering and escaping of hostile inputs across all four formatter methods.

OpenCVE Recommended Actions

  • Apply the vendor‑supplied patch that encodes all user‑controlled data in PDF export (MISP version 2.5.46 or later).
  • Limit PDF report export functionality to trusted administrators or users with verified integrity of data.
  • Enable input filtering or HTML sanitization for attribute, object, and tag fields to prevent injection before they reach the formatter (custom validation or custom code).

Generated by OpenCVE AI on September 10, 2026 at 14:36 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Fri, 11 Sep 2026 10:15:00 +0000

Type Values Removed Values Added
First Time appeared Misp
Misp misp
Vendors & Products Misp
Misp misp

Thu, 10 Sep 2026 17:30:00 +0000

Type Values Removed Values Added
Metrics ssvc

{'options': {'Automatable': 'no', 'Exploitation': 'none', 'Technical Impact': 'partial'}, 'version': '2.0.3'}

Thu, 10 Sep 2026 13:45:00 +0000

Type Values Removed Values Added
Description MISP contains an HTML injection vulnerability in the MISPElementHTMLFormatterTool component, which is responsible for rendering MISP element references (attributes, objects, and tags) into inline HTML during PDF report export via the convert_markdown_to_pdf module. The attribute(), objectAttribute(), object(), and tag() methods interpolated user-controlled fields (attribute type, attribute value, object name, object relation, tag name, tag colour, and tag text colour) directly into HTML templates without applying HTML entity encoding. An authenticated user with the ability to create or modify MISP attributes, objects, or tags could embed arbitrary HTML markup in these fields. When a report containing such elements was exported to PDF, the unescaped content was rendered as live HTML rather than inert text, potentially injecting script tags, breaking the document structure, or altering the visual content of the exported report. Additionally, the attribute() method contained a template with hardcoded sample values ("domain-ip" and "google.com") instead of format placeholders, meaning every plain attribute reference in a PDF displayed the sample text rather than the actual indicator value, constituting a data-integrity defect in the exported document. The vulnerability requires an authenticated actor with write access to MISP elements and a subsequent PDF export of a report referencing those elements. The security impact is primarily to the integrity of the exported document and, depending on the HTML-to-PDF rendering engine, potential execution of injected markup during the conversion step. Version affected: ≤2.5.45
Title MISP: Unescaped HTML Injection in PDF Report Element Rendering
Weaknesses CWE-116
CWE-79
References
Metrics cvssV4_0

{'score': 5.1, 'vector': 'CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:P/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N'}

Subscriptions

Misp Misp
cve-icon MITRE

Status: PUBLISHED

Assigner: CIRCL

Published:

Updated: 2026-09-10T17:02:58.068Z

Reserved: 2026-09-10T13:41:48.297Z

Link: CVE-2026-88921

cve-icon Vulnrichment

Updated: 2026-09-10T17:02:13.564Z

cve-icon NVD

Status : Deferred

Published: 2026-09-10T14:17:19.333

Modified: 2026-09-10T17:17:09.360

Link: CVE-2026-88921

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2026-09-11T10:00:08Z

Weaknesses
  • CWE-116

    Improper Encoding or Escaping of Output

  • CWE-79

    Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')