CVE-2026-94372 in MISP
Summary
by MITRE • 09/21/2026
MISP contains a stored cross-site scripting (XSS) vulnerability in the default theme's Galaxies index page. When a MISP instance detects unknown custom or default galaxy clusters during synchronization, it renders sample tag names in an informational notice directed at site administrators. In the default theme, these sample tag names were inserted into the HTML output without HTML-entity encoding. A user with tag-editor privileges could craft a malicious misp-galaxy tag containing arbitrary script. When a site administrator subsequently viewed the Galaxies index page, the crafted tag content was interpreted as executable markup in the administrator's browser session, enabling the attacker to read session data, perform actions on behalf of the administrator, or otherwise compromise the administrator's browser context. The Overmind theme already applied HTML escaping to the same values and was not affected. The vulnerability requires the attacker to possess tag-editor-level access to create the crafted tag and requires the victim (a site administrator) to view the Galaxies index page in the default theme. The impact is limited to the administrator's browser session and does not directly compromise the MISP server process.
Version affected: <2.5.47
If you want to get best quality of vulnerability data, you may have to visit VulDB.
Analysis
by VulDB Data Team • 09/21/2026
The vulnerability identified as a stored cross-site scripting flaw within the Misinformation Sharing Platform (MISP) affects versions prior to 2.5.47, specifically targeting the default user interface theme's Galaxies index page functionality. This security defect arises from an improper neutralization of input during web content generation, where sample tag names derived from galaxy cluster synchronization processes are rendered directly into HTML output without adequate encoding. When a MISP instance synchronizes with external threat intelligence feeds or internal repositories, it may encounter unknown custom or default galaxy clusters. To assist administrators in understanding these new data structures, the system generates an informational notice containing sample tag names associated with those clusters. In the vulnerable implementation of the default theme, these dynamic values are inserted into the Document Object Model without applying HTML-entity encoding, thereby allowing special characters to be interpreted as executable code rather than plain text by the browser engine.
The operational impact of this vulnerability is significant for organizations relying on MISP for threat intelligence sharing and analysis. An attacker possessing tag-editor privileges can craft a malicious misp-galaxy tag that embeds arbitrary JavaScript payloads within its metadata or name field. This payload remains stored in the database as part of the galaxy cluster definition. When a site administrator, who holds higher-level permissions to view system-wide configurations including the Galaxies index page, accesses this specific interface while using the default theme, their browser parses and executes the embedded script within the context of the MISP application session. This execution environment grants the attacker access to sensitive session data such as authentication cookies or tokens, enabling them to perform actions on behalf of the administrator without further authorization checks. The scope of compromise is confined to the administrative user's browser session, meaning it does not directly lead to server-side code execution or database corruption, but it effectively bypasses role-based access controls through social engineering and context manipulation.
From a classification perspective, this vulnerability aligns with CWE-79, which describes Improper Neutralization of Input During Web Page Generation commonly known as Cross-site Scripting (XSS). The specific nature of the attack involves stored persistence, where malicious scripts are permanently stored within target servers via input fields or database entries and later retrieved for other users. In terms of adversary tactics, this flaw facilitates techniques categorized under MITRE ATT&CK ID T1059, specifically Command and Scripting Interpretation, as well as T1534, Internal Spearphishing if the attacker leverages the compromised session to target internal resources. The vulnerability requires two distinct conditions to be met: the presence of an administrator viewing the specific Galaxies index page using the default theme, and the prior creation of a malicious tag by a user with editor privileges. This dual requirement limits the attack surface compared to reflected XSS but increases the persistence and potential impact due to the stored nature of the payload.
Mitigation strategies should prioritize immediate upgrading to MISP version 2.5.47 or later, where this encoding issue has been resolved in both default and alternative themes like Overmind. For environments unable to upgrade immediately, administrators can mitigate risk by switching to a theme that already implements proper HTML escaping for these specific variables, such as the Overmind theme which was noted as unaffected due to its existing sanitization logic. Additionally, implementing strict Content Security Policy headers can help restrict inline script execution in browsers, providing an additional layer of defense against XSS attacks even if input validation is bypassed. Regular audits of user permissions and monitoring for unusual activity on galaxy cluster synchronization events are also recommended to detect potential exploitation attempts early.