The flaw arises in the AnalystDataController when the object_type parameter taken from the URL is accepted without validation and subsequently injected into translated strings without encoding. This allows an attacker who can craft a URL to embed arbitrary JavaScript that executes in a victim’s browser, enabling session hijacking, data theft, or malicious actions within the MISP application. The weakness is an input validation failure (CWE-20) combined with an absence of output encoding (CWE-116) and the classic cross‑site scripting vector (CWE-79).

MISP versions lower than 2.5.47, specifically the AnalystData controller and the Overmind theme’s analystdata thread element, are affected. Users running any MISP installation preceding 2.5.47 and employing the Overmind theme should consider their systems vulnerable.

The CVSS score of 4.8 indicates moderate severity; the EPSS score is not available, and the vulnerability is not listed in CISA’s KEV catalog. An attacker requires the victim to be authenticated to MISP and to visit a specially crafted URL. Upon meeting these conditions, the reflected script runs with the victim’s privileges, potentially allowing data exfiltration or hijacking. Because the vulnerability is remote and does not require local code execution, it can be exploited by external threat actors as long as they can persuade a user to click or load the malicious link.