CVE-2026-95659 in MISP
Summary
by MITRE • 09/22/2026
MISP contains a reflected cross-site scripting (XSS) vulnerability in the AnalystDataController::viewForObject action. The method accepted a parent object type parameter from the URL without validation and passed it to the Overmind-themed AnalystData thread view element, where it was interpolated into two translated strings and rendered into the HTML response without output encoding. An authenticated attacker who can induce a victim to navigate to a crafted URL can inject arbitrary JavaScript that executes in the victim's browser within the MISP application context. This may allow the attacker to read session data, manipulate the page, or perform actions on behalf of the victim.
The vulnerability requires the victim to be authenticated to MISP and to actively visit the attacker-supplied URL. The affected component is the AnalystData controller and the Overmind theme's AnalystData thread element.
Version affected: <2.5.47
If you want to get best quality of vulnerability data, you may have to visit VulDB.
Analysis
by VulDB Data Team • 09/22/2026
The identified security flaw resides within the MISP platform, specifically affecting versions prior to 2.5.47. This vulnerability manifests as a reflected cross-site scripting issue located in the AnalystDataController::viewForObject action method. The root cause of this weakness is the failure to properly validate or sanitize user-supplied input before its inclusion in an HTML response. Specifically, the application accepts a parent object type parameter directly from the URL query string without performing adequate security checks. This untrusted data is then passed into the Overmind-themed AnalystData thread view element, where it is interpolated into translated strings and rendered directly into the Hypertext Markup Language output without any form of output encoding or escaping.
From a technical perspective, this behavior constitutes a classic instance of input validation failure leading to code injection. The application treats user-controlled data as safe for direct inclusion in dynamic content generation contexts. By failing to encode special characters such as angle brackets, quotes, and ampersands, the server allows an attacker to inject executable JavaScript payloads into the page structure. When the browser parses this response, it interprets the injected script tags or event handlers as legitimate code belonging to the MISP application domain. This bypasses same-origin policy restrictions because the malicious script executes within the context of the trusted origin where the user is authenticated.
The operational impact of this vulnerability is significant for organizations relying on MISP for threat intelligence sharing and management. An attacker who can induce a victim, particularly one with administrative or analyst privileges, to navigate to a crafted URL containing the malicious payload can achieve arbitrary code execution within the application context. This capability allows the adversary to read sensitive session data, including authentication tokens and cookies, which could lead to full account compromise. Furthermore, the attacker can manipulate the page content to deceive users into performing unintended actions or reveal confidential threat intelligence data stored in the local browser storage. The attack vector is primarily social engineering based, requiring active user interaction such as clicking a link or visiting a specific URL constructed by the adversary.
In terms of industry standard classifications, this vulnerability aligns with CWE-79: Improper Neutralization of Input During Web Page Generation, commonly known as Cross-site Scripting (XSS). The reflected nature of the attack corresponds to CWE-80, while the lack of input validation maps closely to CWE-20. From a tactical standpoint within the MITRE ATT&CK framework, this vulnerability facilitates initial access and credential harvesting techniques often associated with T1566: Phishing or T1078: Valid Accounts if used in conjunction with social engineering campaigns. The exploitation relies on tricking an authenticated user into executing code, which is a common pattern in targeted attacks against security operations centers utilizing MISP instances.
To mitigate this risk, organizations must immediately upgrade their MISP deployment to version 2.5.47 or later, where the issue has been resolved through proper input validation and output encoding mechanisms. Until an upgrade can be performed, administrators should consider implementing web application firewall rules that detect and block common XSS payloads in URL parameters related to AnalystData views. Additionally, enforcing strict Content Security Policy headers can help mitigate the impact of any successful injection by restricting script execution sources. Regular security audits focusing on input handling in controller actions are recommended to prevent similar vulnerabilities from being introduced during future development cycles or custom theme modifications.