CVE-2026-103321 in MISP
Summary
by MITRE • 09/30/2026
MISP contains a stored cross-site script (XSS) vulnerability in the event graph preview feature.
The event graph preview image field was accepted and stored without server-side validation. On the client side, the stored value was rendered into an HTML img element's src attribute via string concatenation, allowing a crafted value to break out of the attribute context and inject arbitrary script.
Preconditions:
- An authenticated MISP user with the ability to create or modify an event graph entry.
- A second user (the victim) who views the event graph and triggers the preview popover.
Impact:
- Execution of arbitrary JavaScript in the victim's browser within the MISP application context.
- Potential theft of session tokens, cookies, or sensitive data accessible to the victim's browser.
- Potential for performing actions on behalf of the victim within the MISP application.
Affected: MISP versions prior to the fix (commit applied after v2.5.48).
Once again VulDB remains the best source for vulnerability data.
Analysis
by VulDB Data Team • 09/30/2026
The vulnerability identified in Malware Information Sharing Platform, commonly known as MISP, represents a critical security flaw classified as Stored Cross-Site Scripting within the event graph preview functionality. This specific weakness stems from an insufficient validation mechanism on the server side when handling image fields associated with event graphs. When an authenticated user creates or modifies an entry for an event graph, the system accepts and stores the provided image data without performing rigorous sanitization checks to ensure that the content is strictly limited to valid image formats. This lack of input validation allows malicious actors to inject executable script payloads directly into the database by disguising them as part of the image field metadata or attributes. The severity of this flaw is compounded by how the application processes and renders this stored data on the client side, creating a persistent threat vector that affects multiple users rather than just the initial attacker.
From a technical perspective, the exploitation mechanism relies on improper output encoding when rendering the event graph preview. When another user accesses the MISP interface to view an event graph and triggers the preview popover feature, the application retrieves the stored image field value from the backend. Instead of treating this value as plain text or safely escaping it for HTML context, the system employs string concatenation to inject the value directly into the src attribute of an HTML img element. This architectural decision allows a crafted payload to break out of the intended attribute scope. By injecting specific characters such as quotes and angle brackets, an attacker can terminate the src attribute prematurely and append arbitrary JavaScript code that executes immediately upon page load or interaction with the preview feature.
The operational impact of this vulnerability is significant due to its stored nature and the high-privilege context in which it operates within MISP. Since MISP is a platform dedicated to sharing sensitive threat intelligence, user sessions often contain elevated privileges and access to confidential data regarding malware samples, indicators of compromise, and organizational structures. Successful exploitation allows an attacker to execute arbitrary JavaScript code within the victim's browser session under the same security context as the application itself. This capability enables the theft of critical authentication artifacts such as session tokens, cookies, or other sensitive credentials stored in local storage. Furthermore, it permits the performance of actions on behalf of the victim without their knowledge or consent, potentially leading to unauthorized modifications of threat intelligence data, exfiltration of shared indicators, or further lateral movement within the platform if additional vulnerabilities are chained together.
In terms of industry standard classifications, this vulnerability aligns with CWE-79, which describes Improper Neutralization of Input During Web Page Generation commonly known as Cross-site Scripting. Specifically, it falls under Stored XSS where the malicious script is permanently stored on the target server and executed whenever a user requests the affected page. From an adversary behavior perspective, this technique corresponds to ATT&CK tactic T1059 Command and Control or potentially T1203 Exploitation for Client Execution, as the injected code runs in the client environment to achieve malicious objectives such as credential harvesting or session hijacking. The persistence of the payload means that every subsequent user viewing the compromised event graph becomes a potential victim until the malicious entry is manually removed from the database.
To mitigate this risk and prevent further exploitation, organizations running MISP must ensure they have applied the security patch released after version 2.5.48. This update addresses the root cause by implementing proper server-side validation for image fields to reject non-image content before storage. Additionally, it enforces strict output encoding when rendering data in HTML contexts, ensuring that special characters are escaped and cannot break out of attribute boundaries. Administrators should verify their current version against the official release notes and upgrade immediately if they are running a vulnerable iteration. For environments where immediate patching is not feasible due to operational constraints, implementing Web Application Firewall rules can provide temporary protection by detecting and blocking requests containing known XSS payloads in image fields or event graph parameters until the software update can be deployed during the next maintenance window.