MISP contains a reflected cross‑site scripting vulnerability in the attribute histogram view. The selectedTypes variable, derived from a URL path segment, is inserted directly into a JavaScript array literal inside an onClick HTML attribute without encoding. An attacker who can persuade an authenticated MISP user to visit a crafted URL can execute arbitrary JavaScript in the victim’s browser within the MISP origin. This flaw allows the attacker to read session cookies, perform actions on behalf of the victim, or exfiltrate sensitive data from the interface.

Affected systems include installations of the MISP open‑source platform that have not applied the commit that replaces the unsafe raw PHP loop with a json_encode() call using JSON_HEX_TAG, JSON_HEX_APOS, JSON_HEX_QUOT, and JSON_HEX_AMP flags. Versions prior to this fix, regardless of patch level, are vulnerable.

The CVSS score of 5.1 indicates a moderate severity. EPSS is not available, and the vulnerability is not listed in CISA’s KEV catalog. Exploitation requires the victim to be authenticated and to actively navigate to the attacker‑supplied URL, suggesting a social‑engineering or phishing attack vector. Because the vulnerability is reflected and client‑side, the attack surface is limited to users with legitimate MISP access, but the impact on confidentiality, integrity, and availability of the user session is potentially high.