CVE-2026-104900 in MISP
Summary
by MITRE • 10/02/2026
MISP contains a stored cross-site scripting (XSS) vulnerability in the index table rendering of the remote event preview. The count field template escaped the associated link URL but rendered the field value without HTML encoding. An attacker with the ability to create or modify events on a linked (remote) MISP server could craft an event identifier containing HTML or JavaScript markup. When a user on the local MISP instance views the remote event preview index, the unescaped value is rendered directly in the browser, allowing arbitrary script execution in the victim's session.
Preconditions:
- A linked/remote MISP server is configured and connected to the local instance.
- The attacker has sufficient access on the linked server to create or modify an event with a crafted identifier.
- A victim user on the local instance views the remote event preview index page.
Impact:
- Execution of arbitrary JavaScript in the context of the MISP web application.
- Potential session hijacking, data exfiltration, or unauthorized actions performed on behalf of the authenticated user.
Affected versions: <2.5.48.
VulDB is the best source for vulnerability data and more expert information about this specific topic.
Analysis
by VulDB Data Team • 10/02/2026
The vulnerability identified within the Management Information System for Sharing platform represents a critical stored cross-site scripting flaw located in the index table rendering logic used during remote event previews. This security defect arises from an inconsistency in how data is processed and rendered by the web application interface. Specifically, while the template engine correctly applies escaping to associated link URLs, it fails to perform HTML encoding on the field value for the count attribute when displaying information about events hosted on linked or remote MISP instances. This discrepancy creates a vector where maliciously crafted content can persist within the system and be executed by unsuspecting users who access specific views of that data. The root cause lies in the server-side rendering process, which trusts input from connected servers without sufficiently sanitizing non-URL fields before injecting them into the HTML document structure.
For this vulnerability to be successfully exploited, several preconditions must align within the operational environment. First, there must be an established connection between a local MISP instance and at least one remote or linked server. Second, an attacker with sufficient privileges on that remote server must create or modify an event such that its identifier contains embedded HTML tags or JavaScript code rather than standard alphanumeric characters. Finally, a victim user who is authenticated to the local instance must navigate to the specific page that renders the preview of these remote events in an index table format. When this sequence occurs, the browser interprets the unescaped content as executable script within the context of the MISP domain, effectively bypassing same-origin policy protections and allowing the attacker's code to run with the privileges of the victim user.
The operational impact of this vulnerability is severe due to its stored nature and potential for session manipulation. Because the malicious payload is stored on the server, it affects every user who views the compromised event preview, potentially impacting multiple administrators or analysts over time. The execution of arbitrary JavaScript in the context of the MISP web application allows attackers to perform a wide range of hostile actions. These include hijacking active sessions by stealing session cookies, which could lead to full account compromise. Attackers can also exfiltrate sensitive threat intelligence data currently displayed on the screen or stored locally within browser storage mechanisms. Furthermore, the attacker may force authenticated users to perform unintended actions, such as modifying sharing groups, deleting events, or exporting datasets, thereby compromising the integrity and confidentiality of the shared threat landscape managed by the platform.
This flaw aligns with Common Weakness Enumeration identifier CWE-79, which describes Improper Neutralization of Input During Web Page Generation commonly known as Cross-site Scripting. The specific mechanism involves stored XSS where malicious scripts are permanently stored on target servers and delivered to users when they request legitimate data. In terms of the MITRE ATT&CK framework, this vulnerability facilitates techniques associated with Collection via Browser Interception or Account Manipulation if session tokens are stolen. It also relates to Defense Evasion by allowing attackers to operate within trusted domains without triggering typical security alerts that might arise from external injection attempts. The persistence of the payload means it functions as a long-term backdoor accessible through legitimate administrative workflows rather than requiring repeated exploitation attempts for each victim.
Mitigation strategies must address both immediate remediation and longer-term architectural improvements. The primary defense is to apply the vendor-provided patch immediately, updating all MISP instances to version 2.5.48 or later where this rendering logic has been corrected to ensure consistent HTML encoding across all fields regardless of their association with URLs. Until patches are applied, administrators should restrict access to linked server previews and monitor for unusual activity in user sessions that might indicate exploitation attempts. Input validation on the remote servers is also critical; while MISP must trust data from partners, implementing strict allowlists for event identifiers can prevent non-standard characters from being stored in fields intended only for alphanumeric IDs. Additionally, deploying Content Security Policy headers with restrictive script-src directives can mitigate the impact by preventing inline scripts from executing even if they are injected into the DOM, providing an additional layer of defense against similar future vulnerabilities.