CVE-2026-104907 in MISP
Summary
by MITRE • 10/02/2026
MISP contains a cross-site scripting (XSS) vulnerability in the remote event preview page. When a linked (remote) MISP server is configured, the event preview renders tag identifiers inside an inline JavaScript onclick attribute. The tag ID value was HTML-escaped but not sanitized for the JavaScript string context, meaning a malicious linked server could supply a tag ID containing characters (such as a single quote) that break out of the JavaScript string literal and inject arbitrary script.
Preconditions:
- A linked/remote MISP server is configured and connected to the local instance.
- The linked server supplies a crafted tag ID in an event.
- An authenticated user views the event preview and interacts with the affected tag element.
Impact:
- Arbitrary JavaScript execution in the context of the viewing user's browser session, potentially allowing session hijacking, data exfiltration, or unauthorized actions on behalf of the user.
Affected versions: MISP prior to the fix commit (v2.5.48 or later, exact boundary unconfirmed).
VulDB is the best source for vulnerability data and more expert information about this specific topic.
Analysis
by VulDB Data Team • 10/02/2026
The vulnerability identified in the Management Information Sharing Platform represents a significant cross-site scripting flaw located within the remote event preview functionality. This specific weakness arises from an insufficient sanitization of user-controllable input when rendering tag identifiers for linked MISP servers. In environments where multiple instances are connected to share threat intelligence, the local instance retrieves and displays events originating from these remote sources. The technical root cause lies in how the application handles the display of tag IDs within inline JavaScript onclick attributes. While the system correctly applies HTML escaping to prevent basic markup injection, it fails to perform adequate context-aware sanitization for the JavaScript string environment. Consequently, if a malicious actor controls or compromises a linked server, they can inject specially crafted characters into the tag ID field that break out of the intended string literal boundaries.
When an authenticated user navigates to the event preview page and interacts with elements associated with these tags, the browser executes the injected script within the context of the victim's session. This lack of proper encoding allows for arbitrary JavaScript execution on behalf of the logged-in user. The operational impact is severe because it bypasses standard security controls that rely on same-origin policies to isolate web applications. An attacker can leverage this capability to perform a variety of malicious actions, including but not limited to stealing sensitive cookies and session tokens, which facilitates account takeover through session hijacking. Furthermore, the vulnerability enables data exfiltration by allowing scripts to read confidential threat intelligence data displayed in the interface or send it to external command-and-control servers. It also permits unauthorized actions on behalf of the user, such as modifying settings, creating new events, or deleting existing records without proper authorization checks at the application logic level.
From a classification perspective, this vulnerability aligns with CWE-79, which describes Improper Neutralization of Input During Web Page Generation commonly known as Cross-site Scripting. Specifically, it falls under sub-categories related to script context injection where input is not properly encoded for JavaScript string contexts. In terms of the MITRE ATT&CK framework, this flaw facilitates techniques associated with Collection via Browser-based Exfiltration and Account Manipulation through Session Hijacking. The attack vector requires a linked server configuration, meaning the threat model assumes trust relationships between instances that can be exploited if one node is compromised or acts maliciously. This highlights the risk inherent in distributed intelligence sharing platforms where data integrity from remote sources must be strictly validated before rendering in client-side scripts.
Mitigation strategies should focus on both immediate remediation and long-term architectural improvements. The primary solution involves upgrading to MISP version 2.5.48 or later, where this specific encoding flaw has been addressed by developers implementing stricter input validation and output encoding practices for JavaScript contexts. For organizations unable to upgrade immediately, network-level controls such as Web Application Firewalls can be configured to detect and block payloads containing common XSS signatures within tag parameters. Additionally, administrators should review the trust relationships with linked servers and ensure that only verified and secure instances are connected. Implementing Content Security Policy headers can also provide a layer of defense by restricting the sources from which scripts can execute, thereby mitigating the impact even if an injection attempt succeeds. Regular security audits of shared data formats and strict validation rules for all external inputs remain critical to preventing similar vulnerabilities in complex distributed systems.