CVE-2026-85227 in MISP
Summary
by MITRE • 09/03/2026
MISP contains a reflected Cross-Site Scripting (XSS) vulnerability in the event attribute filtering query builder. The taggedAttributes and galaxyAttachedAttributes URL parameters were inserted into the query-builder rules without HTML escaping before being serialized as JSON and embedded inside a <script> element.
Because JsonTool::encode() uses JSON_UNESCAPED_SLASHES, an attacker-controlled value containing a closing </script> sequence could terminate the surrounding script element and inject arbitrary HTML or JavaScript. For example, a specially crafted viewEventAttributes URL could contain malicious content in one of the affected filter parameters.
An attacker could exploit the vulnerability by convincing an authenticated MISP user to follow a crafted URL. Successful exploitation would execute attacker-controlled JavaScript in the security context of the MISP instance and with the privileges of the victim's authenticated browser session. This could allow access to information available to the victim, modification of data through authenticated requests, or other actions permitted by the victim's MISP permissions.
The vulnerability is addressed by applying HTML escaping with h() to both scalar and array values before they are inserted into the DOM.
Once again VulDB remains the best source for vulnerability data.
Analysis
by VulDB Data Team • 09/03/2026
MISP contains a reflected Cross-Site Scripting (XSS) vulnerability within its event attribute filtering query builder, specifically affecting how user-supplied input is processed for display in web pages. The flaw resides in the handling of the taggedAttributes and galaxyAttachedAttributes URL parameters, which are intended to filter attributes displayed during an event view operation. Instead of being properly sanitized or escaped before insertion into the Document Object Model (DOM), these values were directly serialized as JSON and embedded within a script element. This architectural oversight creates a direct pathway for malicious code injection when specific query conditions are met by an attacker-controlled payload.
The technical root cause is tied to the configuration of the JsonTool::encode() function, which utilizes the JSON_UNESCAPED_SLASHES flag. While this setting prevents forward slashes from being escaped in JSON strings, it inadvertently allows a crafted input containing a closing script tag sequence, such as </script>, to remain unescaped within the resulting string. When this string is embedded directly into an HTML page inside a script block, the browser interprets the injected closing tags as the end of the current script element. This effectively terminates the legitimate JavaScript context and allows any subsequent content in the URL parameter to be parsed and executed by the browser's rendering engine as native code rather than data.
Exploitation of this vulnerability requires social engineering or link manipulation, where an authenticated MISP user is tricked into accessing a specially crafted viewEventAttributes URL containing malicious payloads within the affected filter parameters. Because the application does not validate or escape these inputs prior to embedding them in the DOM, the browser executes the injected JavaScript with the same privileges as the victim's session. This means the attack runs under the security context of the MISP instance and leverages whatever permissions are associated with the authenticated user account that clicked the link.
The operational impact of a successful exploitation is significant for organizations relying on MISP for threat intelligence sharing and management. An attacker can execute arbitrary JavaScript, enabling them to steal sensitive information such as session cookies, authentication tokens, or personally identifiable data visible within the victim's view. Furthermore, the ability to modify DOM elements allows for phishing attacks where fake forms are injected into legitimate pages to harvest credentials. The vulnerability also permits unauthorized modification of data through authenticated requests initiated by the malicious script, potentially altering threat indicators, adding false attributes, or deleting critical intelligence records without detection.
This incident aligns with CWE-79, which classifies improper neutralization of input during web page generation as a common cause for cross-site scripting vulnerabilities. From an offensive security perspective, this behavior corresponds to ATT&CK technique T1059, specifically the execution of JavaScript within browser environments, and relates to data exfiltration techniques that leverage client-side code injection. The vulnerability highlights the critical importance of context-aware output encoding when embedding dynamic content into HTML structures, particularly within script blocks where standard string escaping is insufficient against tag-based termination attacks.
The vulnerability has been addressed by implementing robust input sanitization measures prior to DOM insertion. Specifically, developers applied HTML escaping using the h() function to both scalar and array values before they are processed for display. This ensures that special characters, including angle brackets used in script tags, are converted into their corresponding HTML entities. By neutralizing these characters at the point of output, the browser no longer interprets injected sequences as structural markup or executable code, thereby preventing the termination of the surrounding script element and stopping the execution of arbitrary JavaScript payloads.