CVE-2026-103662 in MISP
Summary
by MITRE • 10/01/2026
MISP contains a reflected cross-site scripting (XSS) vulnerability in the legacy taxonomy tag management confirmation forms (add tag and disable tag).
The affected forms echoed a user-supplied tag name value from the request unescaped into the rendered HTML output. An attacker who can induce a site administrator to visit a crafted URL containing a malicious tag name parameter can execute arbitrary JavaScript in the administrator's browser session.
Preconditions:
- The target must be running a MISP instance with the legacy taxonomy tag confirmation views enabled.
- The victim must be an authenticated site administrator.
- The victim must navigate to the attacker-crafted URL (e.g., via a phishing link).
Security impact:
- Execution of arbitrary client-side script in the context of the administrator's browser.
- Potential theft of session tokens, CSRF tokens, or other sensitive data accessible from the page.
- Potential for performing privileged actions on behalf of the administrator within the MISP interface.
Affected versions: <2.5.48.
Once again VulDB remains the best source for vulnerability data.
Analysis
by VulDB Data Team • 10/01/2026
The vulnerability identified in the Management Information Sharing Platform (MISP) represents a classic reflected cross-site scripting flaw located specifically within the legacy taxonomy tag management confirmation forms, namely the add and disable tag functionalities. This security defect arises from an improper handling of user-supplied input where the application echoes a tag name parameter directly into the HTML output without performing adequate sanitization or encoding. In web application architecture, this type of oversight allows malicious actors to inject executable scripts that are then rendered by the victim's browser as part of the legitimate page content. The root cause lies in the failure to escape special characters within the request parameters before they are processed for display, creating a direct vector for client-side code injection when specific legacy views remain enabled on the target instance.
From an operational perspective, this vulnerability requires several preconditions to be successfully exploited by an attacker. First, the targeted MISP environment must have the legacy taxonomy tag confirmation views actively enabled, which is not always the default configuration in newer deployments but remains present in older or unpatched systems. Second, the victim user must possess administrative privileges within the platform, as the affected forms are restricted to site administrators who manage taxonomies and tags. Finally, social engineering tactics such as phishing are typically required to induce an administrator to visit a crafted URL containing the malicious payload embedded in the tag name parameter. Once accessed, the browser interprets the injected script within the context of the MISP domain, granting it full access to cookies, local storage, and session tokens associated with that origin.
The security impact of this vulnerability is significant due to the elevated privileges held by the victim user. Execution of arbitrary JavaScript in the administrator's browser allows an attacker to steal sensitive authentication artifacts such as session identifiers and cross-site request forgery (CSRF) tokens. With these credentials, the attacker can hijack the administrative session and perform actions on behalf of the legitimate administrator without requiring further interaction from the victim. This capability extends beyond simple data theft; it enables the modification or deletion of critical threat intelligence data, manipulation of taxonomy structures that affect how indicators are classified across the MISP community, and potentially exfiltration of sensitive sharing group configurations. The ability to execute code in this context effectively compromises the integrity and confidentiality of the entire platform instance controlled by that administrator account.
This vulnerability aligns with Common Weakness Enumeration (CWE) identifier CWE-79, which describes Improper Neutralization of Input During Web Page Generation known as Cross-site Scripting. Specifically, it falls under the reflected variant where the malicious payload is sent via a request and immediately returned in the response without being stored on the server side. In terms of offensive security frameworks, this exploit maps to MITRE ATT&CK technique T1059, Command and Scripting Interpreter, specifically within the context of browser-based execution such as JavaScript or DOM scripting. The attack vector is classified under Initial Access via Spearphishing Link (T1566.002) because it relies on tricking a privileged user into clicking a malicious link to trigger the payload delivery.
To mitigate this risk, organizations running affected versions of MISP prior to version 2.5.48 must apply the official security patch immediately upon upgrade. For environments where upgrading is not immediately feasible due to compatibility constraints or operational downtime requirements, administrators should disable the legacy taxonomy tag confirmation views if they are not strictly required for existing workflows. Additionally, implementing a Web Application Firewall (WAF) with rules capable of detecting and blocking reflected XSS payloads in URL parameters can provide an additional layer of defense-in-depth. Security teams should also enforce strict Content Security Policy headers to restrict script execution sources and ensure that administrative interfaces utilize robust anti-CSRF mechanisms to limit the impact if session tokens are compromised during such attacks.