CVE-2026-112184
Deferred Deferred - Pending Action

Reflected XSS in MISP Workflow Module Interface

Publication date: 2026-10-19

Last updated on: 2026-10-19

Assigner: CIRCL

Description
MISP contains a reflected cross-site scripting (XSS) vulnerability in the workflow module interface. Parameter names returned by the misp-modules service are rendered as raw HTML form labels on the workflow module page without output encoding. An attacker who can influence the parameter names reported by the misp-modules service can inject arbitrary HTML or JavaScript that executes in the context of an authenticated MISP user's browser. Preconditions: - The attacker must be able to control or influence parameter names reported by the misp-modules service. - A victim must be authenticated and view the affected workflow module page. Impact: - Execution of arbitrary JavaScript in the victim's browser session. - Potential theft of session tokens, manipulation of the MISP interface, or initiation of unauthorized actions on behalf of the victim. Affected versions: <2.5.48.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-10-19
Last Modified
2026-10-19
Generated
2026-10-19
AI Q&A
2026-10-19
EPSS Evaluated
N/A
NVD
CVE-2026-112184
EUVD
EUVD-2026-104142

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
MISP MISP 0

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-79 The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

MISP has a reflected cross-site scripting (XSS) vulnerability in its workflow module interface. The issue occurs because parameter names from the misp-modules service are displayed as raw HTML form labels without proper output encoding. An attacker who can manipulate these parameter names can inject malicious HTML or JavaScript code that executes in the browser of an authenticated MISP user.

Detection Guidance

To detect this vulnerability, inspect the workflow module page in MISP for parameter names rendered as raw HTML. Check if misp-modules service returns parameter names containing HTML or JavaScript code. Use browser developer tools to examine the page source for unescaped parameter values.

Impact Analysis

This vulnerability allows an attacker to execute arbitrary JavaScript in your browser session if you are authenticated and view the affected workflow module page. This could lead to theft of session tokens, unauthorized actions on your behalf, or manipulation of the MISP interface.

Compliance Impact

This vulnerability could potentially impact compliance with GDPR and HIPAA by enabling unauthorized access to sensitive data through session token theft or interface manipulation. An attacker could execute arbitrary JavaScript in a victim's browser, leading to data exfiltration or unauthorized actions, which may violate data protection requirements.

Mitigation Strategies

Upgrade MISP to version 2.5.48 or later to apply the security fix. If immediate upgrade is not possible, restrict access to the workflow module page to trusted users only. Monitor misp-modules service output for suspicious parameter names.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-112184. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart