The vulnerability arises when the organization name configured for MISP.org is inserted into a JavaScript string on the admin email composition page without any escaping. An attacker who can set or modify that name can include a double‑quote or backslash to terminate the string literal and inject arbitrary JavaScript. When a second authenticated user later opens the view, the malicious code runs in the victim’s browser session, enabling session hijacking, data exfiltration, or the execution of privileged actions on behalf of the target. The weakness is an instance of insufficient output encoding in a JavaScript context, as identified by CWE‑79.

Any MISP installation that stores the MISP.org organization name in the database and renders it directly into a JavaScript string is affected. It is inferred that self‑hosted deployments, where administrators control the organization name setting locally, are the most likely to remain vulnerable until the vendor patch is applied. Managed or cloud‑hosted services that have already applied the patch are not affected.

The CVSS score of 4.8 indicates moderate impact, and the vulnerability is not listed in the CISA KEV catalog. Exploitation requires an authenticated user with permission to edit the organization name and a second authenticated user who subsequently visits the vulnerable page. The EPSS score is unavailable, so the likelihood of exploitation is uncertain, but the static nature of the stored payload means that once injected, the payload will affect every subsequent user who views the page. The attack surface is limited to systems where both conditions are met, yet the consequences for each victim can be significant due to the nature of the XSS payload.