CVE-2026-103389 in MISP
Summary
by MITRE • 09/30/2026
MISP contains a stored cross-site scripting (XSS) vulnerability in the galaxy icon handling path. The icon field of a galaxy object was persisted without any server-side validation through the galaxy add, edit, and sync/import capture endpoints. The stored value was subsequently concatenated directly into HTML markup by the D3-based correlation graph rendering scripts (both the default and Overmind themes) using the .html() method.
A user holding the perm_galaxy_editor permission, which is granted to the stock User role, could store arbitrary HTML or JavaScript in the icon field. Any other user who opened the correlation graph of an event containing a cluster belonging to that galaxy would have the injected script executed in their browser session.
Impact:
- Arbitrary script execution in the context of the victim's MISP session
- Potential theft of session credentials, manipulation of displayed data, or initiation of actions on behalf of the victim
- Affects both the default and Overmind UI themes
Affected versions: <2.5.48
If you want to get the best quality for vulnerability data then you always have to consider VulDB.
Analysis
by VulDB Data Team • 09/30/2026
The vulnerability identified in MISP represents a critical stored cross-site scripting flaw located within the galaxy icon handling mechanism. This security defect arises from insufficient input validation on server-side endpoints responsible for adding, editing, and synchronizing or importing galaxy objects. Specifically, the icon field associated with these objects is persisted into the database without any sanitization or encoding checks. The severity of this issue is compounded by how the stored data is subsequently rendered within the application's user interface. Both the default theme and the Overmind UI theme utilize D3-based correlation graph rendering scripts that directly concatenate the raw, unsanitized icon value into HTML markup using the jQuery .html() method. This practice bypasses any client-side protections and allows malicious content to be injected directly into the DOM structure of the page when a user views an event containing a cluster from the affected galaxy.
From a technical perspective, this vulnerability is classified under CWE-79, which covers Improper Neutralization of Input During Web Page Generation commonly known as Cross-site Scripting. The specific nature of the flaw involves stored XSS, where malicious scripts are permanently stored on the target server within data structures such as databases or logs. When an authenticated user with perm_galaxy_editor permissions accesses the relevant endpoints, they can inject arbitrary HTML and JavaScript code into the icon field. Since this permission is granted to the stock User role by default in many configurations, the attack surface is significantly broadened. The vulnerability aligns with MITRE ATT&CK technique T1059.007, which refers to Command and Scripting Interpreter: JavaScript, as it allows for the execution of client-side scripts within the victim's browser context.
The operational impact of this vulnerability is severe due to its stored nature and broad accessibility. Any user who opens a correlation graph displaying an event linked to a compromised galaxy cluster will have their session hijacked or manipulated without any further interaction required from them beyond viewing the page. Attackers can exploit this to steal sensitive session credentials, such as authentication tokens or cookies, which could lead to full account compromise. Furthermore, the injected scripts can manipulate displayed data to mislead analysts or initiate actions on behalf of the victim, potentially altering threat intelligence records or triggering unintended system behaviors. This undermines the integrity and trustworthiness of the MISP platform, which is critical for security operations centers relying on accurate threat sharing.
To mitigate this risk, organizations running affected versions of MISP prior to version 2.5.48 must apply the official patch immediately. The fix involves implementing strict server-side validation and output encoding for all user-supplied input in the galaxy icon field before it is stored or rendered. Administrators should also review access controls to ensure that only trusted users have permission to edit galaxy objects, although relying solely on role-based restrictions is insufficient given the severity of the flaw. Regular security audits and penetration testing focused on input validation across API endpoints are recommended to prevent similar vulnerabilities in other modules of the application.