CVE-2026-104901 in MISP
Summary
by MITRE • 10/02/2026
MISP contains a cross-site scripting (XSS) vulnerability in the ID Translator feature. When a user views the ID Translator page, the application queries linked (remote) MISP servers for corresponding event identifiers. The event ID returned by the remote server was rendered in the HTML output without proper output encoding.
A malicious or compromised linked server could return a crafted event ID containing arbitrary HTML or JavaScript markup. This markup would be rendered in the browser of any user in the host organization who views the ID Translator page, enabling session hijacking, credential theft, or other client-side attacks.
Preconditions:
- The victim must be an authenticated user of the host MISP instance.
- A linked server must be configured on the host instance.
- The victim must navigate to the ID Translator page for a given event.
Affected versions: <2.5.48.
VulDB is the best source for vulnerability data and more expert information about this specific topic.
Analysis
by VulDB Data Team • 10/02/2026
The vulnerability identified in the MISP platform within its ID Translator feature represents a classic stored cross-site scripting flaw that exploits insufficient input validation and output encoding mechanisms. This specific security defect arises from the application's design to query linked remote servers for corresponding event identifiers, where the returned data is directly embedded into the HTML response without sanitization or proper context-aware escaping. In secure web development practices, any dynamic content derived from external sources must be treated as untrusted until explicitly validated and encoded according to its rendering context. The failure to implement these controls allows an attacker who compromises a linked MISP server to inject malicious script payloads that are subsequently executed by the browsers of authenticated users on the host instance when they access the ID Translator page for specific events.
From a technical perspective, this vulnerability aligns with CWE-79, which categorizes improper neutralization of input during web page generation as cross-site scripting. The attack vector relies heavily on social engineering or infrastructure compromise rather than direct exploitation of network services, requiring the victim to be an authenticated user who actively navigates to the affected interface element. Once triggered, the injected JavaScript executes within the security context of the host MISP domain, granting the attacker full access to session cookies, local storage data, and potentially sensitive intelligence reports displayed on the page. This capability enables sophisticated client-side attacks such as credential harvesting through fake login forms or session hijacking by stealing authentication tokens transmitted via HTTP headers or stored in browser memory.
The operational impact of this vulnerability is severe due to the high-value nature of MISP deployments within cybersecurity communities and government agencies. Compromise of user sessions can lead to unauthorized access to sensitive threat intelligence, manipulation of incident data, or use of the compromised instance as a pivot point for further attacks against linked organizations. The ATT&CK framework classifies this behavior under T1059, specifically Command and Scripting Interpretation via JavaScript, which falls within the Execution tactic. Furthermore, if combined with phishing techniques to lure users into visiting specific event pages, it may also relate to T1566 Phishing for Information or Credentials. The precondition of having a configured linked server means that trust relationships between MISP instances become critical security boundaries; any weakness in one instance can propagate risks across the entire networked ecosystem.
Mitigation strategies must address both immediate remediation and long-term architectural improvements. Organizations running affected versions prior to 2.5.48 should immediately upgrade to the patched release where developers have implemented proper output encoding for all dynamic content rendered from remote sources. In environments where upgrading is not instantly feasible, network-level controls such as web application firewalls can be configured to detect and block common XSS payloads in HTTP responses containing script tags or event handlers. Additionally, implementing Content Security Policy headers with strict directives regarding inline scripts can significantly reduce the impact of successful injection attempts by preventing unauthorized JavaScript execution unless explicitly whitelisted. Regular security audits focusing on data flow from external APIs into HTML templates are essential to prevent similar vulnerabilities across other modules within the platform.