MISP contains a DOM‑based cross‑site scripting flaw in the contextual menu component. The JavaScript code uses innerHTML to insert option labels from user‑controllable data, causing any HTML or script in those values to be parsed and executed in the victim’s browser at the MISP origin. An attacker who can influence the menu content can run arbitrary code, hijack the victim’s session, exfiltrate data, or perform unauthorized actions while the user is authenticated.

This vulnerability affects the MISP open‑source threat‑information platform, specifically all releases earlier than 2.5.47. The flaw resides in the ContextualMenu class that populates <option> elements.

The CVSS base score of 6.3 indicates a moderate severity. The EPSS score is not available, and the vulnerability is not listed in the CISA KEV catalog, suggesting it may not yet have known exploits. Inferred attack vector is web‑based; an attacker must be able to inject data into the contextual menu, which typically requires the ability to influence user input or upload data that is processed by the menu. Once achieved, the victim’s browser can execute code confined to the MISP origin, allowing session hijacking, data theft, or further authenticated actions.