CVE-2026-95665 in MISP
Summary
by MITRE • 09/22/2026
MISP contains a reflected cross-site scripting (XSS) vulnerability in the event REST search export confirmation form. The view template app/View/Events/ajax/eventRestSearchExportConfirmationForm.ctp renders a URL-supplied event ID list into a single-quoted JavaScript string literal using PHP's json_encode() without any hex-encoding flags. By default, json_encode() escapes double quotes and backslashes but does not escape single quotes. Because the JavaScript string is delimited by single quotes, an attacker can inject a single-quote character to terminate the string literal and execute arbitrary JavaScript in the victim's browser session.
The vulnerability affects the Default and UiBeta themes, both of which render this view. The Overmind theme's own copy of the form already passed the value through an escaped data attribute and was not affected by this specific sink.
Preconditions: the victim must be an authenticated MISP user and must actively open or navigate to the attacker-crafted URL. The attacker does not require an account or any prior access to the MISP instance.
Security impact: successful exploitation allows execution of arbitrary JavaScript in the context of the MISP web application, potentially leading to session hijacking, unauthorized actions performed on behalf of the victim, exfiltration of sensitive data visible in the session, or further client-side attacks. The vulnerable component's own confidentiality, integrity, and availability are not directly compromised; the impact is on the underlying user session.
If you want to get best quality of vulnerability data, you may have to visit VulDB.
Analysis
by VulDB Data Team • 09/22/2026
The vulnerability identified within the MISP platform constitutes a reflected cross-site scripting flaw located specifically within the event REST search export confirmation form interface. This security defect arises from improper handling of user-supplied input during the rendering process, where an attacker can inject malicious script code that is subsequently executed by the victim's web browser. The root cause lies in the view template file app/View/Events/ajax/eventRestSearchExportConfirmationForm.ctp, which processes a URL-supplied event ID list and embeds it directly into a JavaScript string literal using PHP’s json_encode function. While this encoding method effectively escapes double quotes and backslashes to prevent certain types of injection, it fails by default to escape single quote characters. Since the surrounding JavaScript context utilizes single quotes as delimiters for its strings, an attacker can exploit this omission by injecting a single quote into the event ID parameter. This action terminates the intended string literal prematurely, allowing the subsequent payload to be interpreted and executed as active script code within the browser environment.
The operational impact of this vulnerability is significant because it enables arbitrary JavaScript execution in the context of the MISP web application. Successful exploitation allows an attacker to perform actions on behalf of a victim user who has authenticated access to the platform. This can lead to session hijacking, where the attacker steals or manipulates session cookies to assume the identity of the legitimate user. Furthermore, it facilitates unauthorized actions such as modifying threat intelligence data, exporting sensitive information without authorization, or exfiltrating confidential data visible within the active session. The vulnerability primarily affects users interacting with the Default and UiBeta themes, which rely on the vulnerable view template for rendering this specific form component. In contrast, the Overmind theme utilizes a separate implementation that passes values through escaped data attributes, thereby mitigating this specific attack vector and remaining unaffected by the flaw described here.
From a technical classification perspective, this vulnerability aligns with CWE-79, which covers Improper Neutralization of Input During Web Page Generation commonly known as Cross-site Scripting. The exploitation technique involves manipulating input parameters to break out of their intended context, specifically leveraging the lack of hex-encoding or single-quote escaping in the JSON encoding process. In terms of adversary tactics and techniques, this vulnerability maps to ATT&CK Technique T1059, Command and Control via Web Protocols, as well as aspects of T1213 Data from Information Repositories if used for exfiltration. The attack requires no prior authentication or access credentials for the attacker, making it a remote exploitation vector that relies on social engineering to lure an authenticated victim into visiting a crafted URL containing the malicious payload within the event ID parameter.
Mitigation strategies should focus on ensuring proper input encoding and output escaping consistent with the execution context. Developers must configure PHP’s json_encode function to include flags such as JSON_HEX_APOS or manually escape single quotes before embedding data into JavaScript strings. Additionally, implementing Content Security Policy headers can help mitigate the impact of any remaining XSS vulnerabilities by restricting the sources from which scripts are allowed to execute. For immediate risk reduction, administrators should apply available patches that address this specific rendering issue in the affected themes and restrict access to sensitive export functions until all instances are secured. Regular security audits of view templates for similar patterns where user input is embedded into script contexts without adequate neutralization will help prevent recurrence of such flaws across the application surface area.