This vulnerability allows an attacker to inject arbitrary JavaScript into a victim’s browser session by manipulating a JSON string that is rendered inside a single‑quoted JavaScript literal. The flaw arises because json_encode() was called without hex‑encoding flags, so a single‑quote can terminate the string and break out of the intended context. Successful exploitation can result in session hijacking, unauthorized operations performed under the victim’s account, or exfiltration of data visible in the session. The vulnerability does not directly compromise the server or its stored data; the impact is confined to the client side when a logged‑in user visits a crafted URL.

The defect exists in the Default and UiBeta themes of the MISP application, specifically in the view template app/View/Events/ajax/eventRestSearchExportConfirmationForm.ctp. Users running those themes and accessing the event REST search export confirmation form are susceptible. The Overmind theme is not affected because it already sanitises the data attribute used.

The CVSS score is 5.1, indicating a medium severity incident. EPSS data is unavailable, so the current exploitation likelihood is unknown, though the threat existed in public code before the patch. The vulnerability is not listed in the CISA KEV catalog, implying that no known exploits have been reported. Attackers need only craft a malicious URL; an authenticated victim must click it. The primary attack vector is a reflected XSS scenario presented to the user.