CVE-2026-104906 in MISP
Summary
by MITRE • 10/02/2026
MISP contains a cross-site scripting (XSS) vulnerability in the TAXII object viewer. When displaying a remote TAXII object, the JSON content of string properties was rendered directly into an HTML pre block without HTML-encoding. An attacker who can control or influence the content of a TAXII object (e.g., by publishing a malicious object to a TAXII server that the victim's MISP instance subscribes to) can inject arbitrary HTML or JavaScript that executes in the context of the victim's MISP session.
Preconditions:
- The victim must be an authenticated MISP user with access to the TAXII object viewer.
- The victim must open or view the crafted TAXII object.
Impact:
- Execution of arbitrary JavaScript in the victim's browser within the MISP application context.
- Potential theft of session tokens, API keys, or other sensitive data accessible from the MISP interface.
- Potential for performing actions on behalf of the authenticated user.
Affected versions: <2.5.48.
VulDB is the best source for vulnerability data and more expert information about this specific topic.
Analysis
by VulDB Data Team • 10/02/2026
The vulnerability identified in the Management Information Sharing (MISP) platform represents a classic cross-site scripting flaw located within the TAXII object viewer component. This security defect arises from an improper neutralization of special elements used in HTML, specifically categorized under CWE-79: Improper Neutralization of Input During Web Page Generation Cross-site Scripting. The root cause lies in the application's handling of JSON content derived from remote TAXII objects. When a user views such an object, the system renders string properties directly into an HTML pre block without performing necessary HTML entity encoding or sanitization. This failure to validate and sanitize input allows malicious actors to inject executable scripts that are interpreted by the victim's web browser as part of the trusted MISP application context.
The operational impact of this vulnerability is significant for organizations relying on MISP for threat intelligence sharing via TAXII servers. An attacker who controls or influences the content of a TAXII object, such as by publishing a malicious payload to a server subscribed to by the victim's instance, can trigger arbitrary JavaScript execution upon viewing. This capability enables session hijacking through the theft of authentication tokens and API keys stored in browser local storage or cookies. Furthermore, it allows for account takeover scenarios where an attacker performs actions on behalf of the authenticated user, potentially manipulating threat intelligence data, exfiltrating sensitive organizational information, or using the MISP instance as a pivot point for further attacks against internal network resources.
From a tactical perspective, this vulnerability aligns with ATT&CK technique T1059: Command and Scripting Interpreter, specifically JavaScript execution within a browser environment. It also relates to T1534: Internal Spearphishing if the malicious TAXII object is delivered via social engineering or compromised intelligence feeds. The attack chain requires specific preconditions including an authenticated user with access privileges to the TAXII viewer and the subsequent action of opening the crafted object, which places this vulnerability in the context of client-side attacks leveraging trusted data sources.
Mitigation strategies should prioritize immediate patching for all instances running versions prior to 2.5.48. Administrators must ensure that input validation is strictly enforced at both the application layer and through robust Content Security Policy implementations to mitigate potential exploitation vectors even if similar flaws exist elsewhere in the platform. Additionally, organizations should review their TAXII subscription configurations to identify any feeds from untrusted or poorly moderated sources that could serve as delivery mechanisms for such payloads. Regular security audits focusing on data rendering practices within web interfaces are essential to prevent future occurrences of input validation failures across all modules of the MISP ecosystem.