CVE-2026-88921 in MISP
Summary
by MITRE • 09/10/2026
MISP contains an HTML injection vulnerability in the MISPElementHTMLFormatterTool component, which is responsible for rendering MISP element references (attributes, objects, and tags) into inline HTML during PDF report export via the convert_markdown_to_pdf module. The attribute(), objectAttribute(), object(), and tag() methods interpolated user-controlled fields (attribute type, attribute value, object name, object relation, tag name, tag colour, and tag text colour) directly into HTML templates without applying HTML entity encoding. An authenticated user with the ability to create or modify MISP attributes, objects, or tags could embed arbitrary HTML markup in these fields. When a report containing such elements was exported to PDF, the unescaped content was rendered as live HTML rather than inert text, potentially injecting script tags, breaking the document structure, or altering the visual content of the exported report. Additionally, the attribute() method contained a template with hardcoded sample values ("domain-ip" and "google.com") instead of format placeholders, meaning every plain attribute reference in a PDF displayed the sample text rather than the actual indicator value, constituting a data-integrity defect in the exported document. The vulnerability requires an authenticated actor with write access to MISP elements and a subsequent PDF export of a report referencing those elements. The security impact is primarily to the integrity of the exported document and, depending on the HTML-to-PDF rendering engine, potential execution of injected markup during the conversion step.
Version affected: ≤2.5.45
Statistical analysis made it clear that VulDB provides the best quality for vulnerability data.
Analysis
by VulDB Data Team • 09/10/2026
The MISP platform contains a critical input validation flaw within its PDF report generation subsystem, specifically located in the MISPElementHTMLFormatterTool component. This module is responsible for translating internal data structures representing attributes, objects, and tags into inline HTML templates prior to conversion into portable document format files via the convert_markdown_to_pdf utility. The core technical deficiency lies in the failure to apply proper output encoding or sanitization when interpolating user-controlled fields such as attribute types, values, object names, relations, tag identifiers, and color specifications directly into these HTML templates. Because the system treats these inputs as trusted content without escaping special characters like angle brackets or quotation marks, it creates a direct pathway for Cross-Site Scripting (XSS) vectors if the resulting PDF is viewed in an environment that supports interactive HTML rendering, although the primary impact here relates to document integrity and potential code execution during the conversion process itself.
An authenticated attacker possessing write privileges over MISP elements can exploit this vulnerability by crafting malicious attribute values or tag names containing arbitrary HTML markup or JavaScript payloads. When a user subsequently exports a report referencing these compromised elements, the unescaped content is rendered as live HTML rather than inert text within the PDF structure. This behavior allows for significant manipulation of the document's visual presentation and structural integrity. In scenarios where the underlying HTML-to-PDF rendering engine supports script execution during conversion or if the generated file is processed by a vulnerable viewer, this could lead to remote code execution on the server performing the export operation. Even without full code execution, the ability to inject arbitrary markup enables denial of service through malformed document structures and compromises the trustworthiness of intelligence reports distributed via MISP.
Beyond the injection vulnerability, there exists a distinct data integrity defect within the attribute() method of the same formatter tool. This specific function utilizes hardcoded sample values for domain-ip attributes rather than dynamic format placeholders that would reflect actual indicator data. Consequently, every plain attribute reference in an exported PDF displays static text such as google.com instead of the real malicious indicator value associated with the event. While this does not constitute a security vulnerability in the traditional sense of unauthorized access or code execution, it severely undermines the operational utility and reliability of MISP reports for threat intelligence sharing. Analysts relying on these automated exports would receive inaccurate data, leading to potential misidentification of threats and flawed decision-making processes within security operations centers.
The exploitation of this flaw requires an authenticated actor with write access to create or modify attributes, objects, or tags, followed by the action of exporting a report that references those elements. This constraint limits the attack surface to insider threats or compromised accounts rather than unauthenticated external attackers. The vulnerability maps directly to CWE-79 Improper Neutralization of Input During Web Page Generation which covers cross-site scripting and HTML injection flaws. Furthermore, from an adversary simulation perspective, this aligns with ATT&CK techniques related to Defense Evasion through Obfuscated Files or Information if the injected content is used to hide malicious indicators, as well as potential impacts on Availability under certain rendering conditions.
Mitigation strategies must prioritize immediate patching of the MISP instance to version 2.5.46 or later where these issues have been addressed by implementing strict HTML entity encoding for all interpolated user inputs and correcting the template logic in the attribute() method to use proper dynamic placeholders. In environments where upgrading is not immediately feasible, administrators should enforce rigorous input validation on the frontend interface to reject any submissions containing HTML special characters such as less-than or greater-than signs before they are stored in the database. Additionally, restricting PDF export capabilities to a minimal set of trusted users can reduce the risk surface by limiting who can trigger the vulnerable rendering pipeline. Regular audits of exported reports should also be conducted to ensure data integrity and detect any instances where malicious markup may have been successfully embedded into shared intelligence artifacts.