CVE-2026-112183 in MISP
Summary
by MITRE • 10/19/2026
MISP contains a CSS injection vulnerability in the remote event preview feature. When a user previews an event from a linked MISP server, the colour value associated with each remote tag is written directly into an inline CSS style attribute without sufficient validation. Although HTML entity encoding is applied, the value is interpreted as CSS within the style attribute, allowing a malicious or compromised linked server to inject arbitrary CSS declarations.
An attacker with the ability to create or modify tags on a linked MISP instance can craft a tag colour value containing CSS injection payloads. When a user on the local instance views the event preview, the injected CSS is rendered, potentially allowing UI manipulation, visual spoofing, or limited information disclosure through CSS-based techniques.
Preconditions:
- A linked MISP server relationship exists between the victim instance and the attacker-controlled instance.
- The attacker can create or modify tags on the linked server.
- A victim user views the remote event preview page.
Affected: <2.5.48.
Be aware that VulDB is the high quality source for vulnerability data.
Analysis
by VulDB Data Team • 10/19/2026
The vulnerability identified in MISP versions prior to 2.5.48 represents a significant security flaw within the platform's remote event preview functionality, specifically categorized under CSS injection. This issue arises from an insufficient validation mechanism when processing color values associated with tags retrieved from linked MISP servers. When a user on a local instance initiates a preview of an event hosted on a connected external server, the system retrieves metadata including tag colors and embeds these values directly into inline CSS style attributes within the rendered HTML page. Although the implementation attempts to mitigate risks by applying HTML entity encoding to the input data, this defense is circumvented because the encoded content remains valid syntax when interpreted as part of a CSS declaration block rather than raw text. Consequently, an attacker who controls or has compromised permissions on a linked server can inject arbitrary Cascading Style Sheets code that will be executed in the context of the victim's browser session upon viewing the event preview.
From a technical perspective, this flaw exploits the way browsers parse inline styles where certain characters and sequences remain functional even after HTML entity encoding if they are not properly escaped for CSS contexts specifically. The attacker crafts malicious tag color values containing CSS injection payloads such as expressions or properties that can alter the Document Object Model's presentation layer. This allows for UI manipulation, visual spoofing of interface elements to deceive users into performing unintended actions, and potentially limited information disclosure through advanced CSS-based techniques like exfiltrating data via background image requests or font-face tricks. The attack chain requires specific preconditions: a trusted link relationship must exist between the victim's MISP instance and an attacker-controlled server, the attacker must possess the ability to create or modify tags on that linked server, and finally, a legitimate user from the victim organization must view the remote event preview page where the malicious payload is rendered.
The operational impact of this vulnerability extends beyond simple visual distortion. While CSS injection does not typically allow direct execution of JavaScript like Cross-Site Scripting (XSS), it can be leveraged for sophisticated social engineering attacks by masking legitimate UI elements or creating fake login prompts within the MISP interface. Furthermore, attackers may use these techniques to fingerprint user environments or steal sensitive information displayed on the screen through CSS selectors that trigger network requests containing data derived from page content. This undermines the integrity and trustworthiness of the threat intelligence sharing platform, potentially leading to misinterpretation of indicators due to manipulated visual representations of events and tags.
To mitigate this risk, organizations running affected versions of MISP should immediately upgrade to version 2.5.48 or later where these validation checks have been strengthened. In addition to upgrading, administrators should review their linked server configurations and ensure that only trusted instances are connected within the federation network. Implementing strict Content Security Policy headers can also help restrict how stylesheets are processed and loaded, adding an additional layer of defense against injected CSS payloads. Regular audits of tag creation permissions on linked servers further reduce the attack surface by limiting who can introduce potentially malicious metadata into shared events. This vulnerability aligns with CWE-79 which covers improper neutralization of input during web page generation processes, specifically highlighting failures in context-appropriate encoding and escaping for CSS contexts within HTML documents.