CVE-2026-112183
Deferred Deferred - Pending Action

CSS Injection in MISP Event Preview Feature

Publication date: 2026-10-19

Last updated on: 2026-10-19

Assigner: CIRCL

Description
MISP contains a CSS injection vulnerability in the remote event preview feature. When a user previews an event from a linked MISP server, the colour value associated with each remote tag is written directly into an inline CSS style attribute without sufficient validation. Although HTML entity encoding is applied, the value is interpreted as CSS within the style attribute, allowing a malicious or compromised linked server to inject arbitrary CSS declarations. An attacker with the ability to create or modify tags on a linked MISP instance can craft a tag colour value containing CSS injection payloads. When a user on the local instance views the event preview, the injected CSS is rendered, potentially allowing UI manipulation, visual spoofing, or limited information disclosure through CSS-based techniques. Preconditions: - A linked MISP server relationship exists between the victim instance and the attacker-controlled instance. - The attacker can create or modify tags on the linked server. - A victim user views the remote event preview page. Affected: <2.5.48.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-10-19
Last Modified
2026-10-19
Generated
2026-10-19
AI Q&A
2026-10-19
EPSS Evaluated
N/A
NVD
CVE-2026-112183
EUVD
EUVD-2026-104139

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
MISP MISP 0

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-74 The product constructs all or part of a command, data structure, or record using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify how it is parsed or interpreted when it is sent to a downstream component.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

MISP has a CSS injection vulnerability in its remote event preview feature. When a user previews an event from a linked MISP server, the color value of remote tags is inserted directly into a CSS style attribute without proper validation. Even with HTML encoding, the value is interpreted as CSS, allowing attackers to inject malicious CSS payloads. This can lead to UI manipulation or visual spoofing when a victim views the event preview.

Detection Guidance

To detect this vulnerability, inspect MISP event preview pages for remote events. Check if CSS styles in tag colors are properly validated. Look for inline style attributes with unexpected or malicious CSS declarations. Review MISP logs for unauthorized tag modifications or suspicious color values.

Impact Analysis

If you use a MISP instance linked to a compromised or malicious server, an attacker could manipulate the UI you see when previewing events. This might include changing how elements appear, spoofing content, or potentially leaking sensitive information through CSS-based attacks. The impact depends on your role and the data you access.

Compliance Impact

This vulnerability could lead to unauthorized data exposure or UI manipulation, which may violate compliance requirements for data protection (e.g., GDPR, HIPAA). If sensitive information is disclosed or altered due to the CSS injection, it could result in non-compliance with these regulations, potentially leading to legal or financial penalties.

Mitigation Strategies

Upgrade MISP to version 2.5.48 or later to apply the CSS injection fix. Review and validate all remote tag color values in event previews. Remove or restrict linked MISP server relationships with untrusted instances until patched. Monitor for unusual CSS injection attempts in logs.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-112183. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart