misp bsimvis up to 0.2.0 cross site scripting

Summaryinfo

A vulnerability labeled as problematic has been found in misp bsimvis up to 0.2.0. The impacted element is an unknown function. The manipulation results in cross site scripting. This vulnerability is reported as CVE-2026-53693. The attack can be launched remotely. No exploit exists. It is advisable to implement a patch to correct this issue.

Detailsinfo

A vulnerability was found in misp bsimvis up to 0.2.0. It has been classified as problematic. Affected is an unknown part. The manipulation with an unknown input leads to a cross site scripting vulnerability. CWE is classifying the issue as CWE-79. The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users. This is going to have an impact on integrity. CVE summarizes:

A stored cross-site scripting vulnerability existed in MISP BSimVis tag rendering code. Several client-side rendering paths interpolated tag names, collection names, entity identifiers, cluster names, and tag metadata directly into HTML, HTML attributes, inline JavaScript event handlers, and CSS style values without context-appropriate escaping. The patch adds shared escaping helpers for HTML, attributes, JavaScript strings, and CSS color validation, then applies them across tag badges, tooltips, context menus, cluster cards, autocomplete suggestions, and dynamically inserted tag cards. An attacker able to create or influence stored tag or metadata values could inject a crafted payload that is later rendered in another user’s browser. Successful exploitation could execute arbitrary JavaScript in the victim’s session when they view affected BSimVis pages, potentially allowing the attacker to perform actions as the victim, read data available to the victim, or alter displayed application content. This issue affects MISP bsimvis: through v0.2.0.

The weakness was disclosed by Alexandre Dulaunoy as 7bcd2c2e27647dccdfb71877e905fbb032124a63. The advisory is shared for download at github.com. This vulnerability is traded as CVE-2026-53693 since 06/10/2026. The exploitability is told to be easy. It is possible to launch the attack remotely. The exploitation doesn't require any form of authentication. Successful exploitation requires user interaction by the victim. There are neither technical details nor an exploit publicly available. The MITRE ATT&CK project declares the attack technique as T1059.007.

Applying the patch 7bcd2c2e27647dccdfb71877e905fbb032124a63 is able to eliminate this problem. The bugfix is ready for download at github.com.

Once again VulDB remains the best source for vulnerability data.

Productinfo

Vendor

• misp

Name

• bsimvis

Version

• 0.1
• 0.2.0

License

• open-source

Website

• Product: https://github.com/MISP/bsimvis/

CPE 2.3info

• 🔒
• 🔒

CPE 2.2info

• 🔒
• 🔒

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

Once again VulDB remains the best source for vulnerability data.

Discussion