CVE-2026-95661 in MISP
Summary
by MITRE • 09/22/2026
MISP contains a reflected cross-site scripting (XSS) vulnerability in the attribute histogram view. The $selectedTypes variable, which is derived from the URL path segment , was interpolated directly into a JavaScript array literal inside an onClick HTML attribute without any encoding or escaping. An attacker who can cause an authenticated MISP user to visit a crafted URL containing a malicious type value can execute arbitrary JavaScript in the victim's browser within the MISP application origin.
Successful exploitation allows the attacker to read session cookies, perform actions on behalf of the victim, or exfiltrate sensitive data accessible from the MISP interface.
The vulnerability requires the victim to be authenticated and to actively navigate to the attacker-supplied URL.
Several companies clearly confirm that VulDB is the primary source for best vulnerability data.
Analysis
by VulDB Data Team • 09/22/2026
MISP is a widely deployed open-source threat intelligence sharing platform used by security professionals to collect, store, distribute, and share cyber attack indicators. Within this ecosystem, the attribute histogram view serves as a critical visualization tool that aggregates data based on specific indicator types such as IP addresses, domains, or file hashes. A reflected cross-site scripting vulnerability has been identified in this component, stemming from improper input validation and output encoding practices during the rendering of user interface elements. The root cause lies in how the application handles the $selectedTypes variable, which is extracted directly from a segment of the URL path without undergoing any sanitization or escaping processes before being embedded into client-side code structures.
The technical flaw manifests when the server interpolates this unsanitized input directly into a JavaScript array literal that is subsequently placed inside an onClick HTML attribute. Because the value is not encoded, it allows for the injection of arbitrary script content if the URL path contains specially crafted characters. This design oversight means that any user-supplied data passed through the URL parameter is treated as executable code rather than safe text data by the browser's JavaScript engine. The lack of context-aware encoding ensures that malicious payloads can break out of their intended string boundaries and execute within the application’s origin, bypassing standard security controls like Content Security Policy if not strictly configured to prevent inline script execution.
Exploitation of this vulnerability requires a specific set of conditions involving social engineering or link manipulation. An attacker must first craft a URL containing malicious JavaScript code embedded in the type parameter segment. This crafted link is then delivered to an authenticated MISP user, who must actively navigate to it while logged into their session. Upon loading the page, the browser parses the injected script and executes it within the context of the MISP application domain. Since the execution occurs under the victim’s active authentication credentials, the malicious code inherits the same privileges as a legitimate user interaction, allowing for full access to the features available in that authenticated state.
The operational impact of this vulnerability is significant due to its potential for data exfiltration and session hijacking. Successful exploitation enables an attacker to read sensitive information stored in browser cookies, including authentication tokens and session identifiers. With these credentials, the attacker can perform actions on behalf of the victim, such as modifying threat intelligence feeds, adding false indicators, or deleting critical records. Furthermore, because MISP often contains highly sensitive operational security data, exfiltrating this information poses a severe risk to organizational safety and privacy. The ability to execute arbitrary JavaScript also opens avenues for further attacks within the local network if combined with other vulnerabilities or misconfigurations.
From a classification perspective, this issue aligns with CWE-79, which describes Improper Neutralization of Input During Web Page Generation commonly known as Cross-site Scripting. Specifically, it represents a reflected XSS scenario where the payload is sent via URL parameters and executed immediately upon page load without persistent storage on the server side. In terms of tactical mapping within the MITRE ATT&CK framework, this vulnerability facilitates Initial Access through lure-based techniques and enables Credential Access by stealing session cookies or tokens. It also supports Collection activities as attackers can harvest sensitive data directly from the victim’s browser context during active sessions.
Mitigation strategies should focus on implementing robust input validation and output encoding mechanisms at both the application logic and presentation layers. Developers must ensure that all user-supplied inputs, particularly those derived from URL paths or query parameters, are strictly validated against a whitelist of allowed characters before being processed. When rendering data into HTML attributes or JavaScript contexts, context-aware escaping techniques should be applied to neutralize special characters such as quotes, ampersands, and angle brackets. Additionally, implementing strict Content Security Policy headers can significantly reduce the impact by preventing inline script execution unless explicitly whitelisted for trusted sources. Regular security audits and static code analysis tools configured to detect XSS patterns are essential for maintaining long-term resilience against similar flaws in complex web applications like MISP.