CVE-2026-53693
Received Received - Intake
Stored XSS in MISP BSimVis Tag Rendering

Publication date: 2026-06-10

Last updated on: 2026-06-10

Assigner: 5a6e4751-2f3f-4070-9419-94fb35b644e8

Description
A stored cross-site scripting vulnerability existed in MISP BSimVis tag rendering code. Several client-side rendering paths interpolated tag names, collection names, entity identifiers, cluster names, and tag metadata directly into HTML, HTML attributes, inline JavaScript event handlers, and CSS style values without context-appropriate escaping. The patch adds shared escaping helpers for HTML, attributes, JavaScript strings, and CSS color validation, then applies them across tag badges, tooltips, context menus, cluster cards, autocomplete suggestions, and dynamically inserted tag cards. An attacker able to create or influence stored tag or metadata values could inject a crafted payload that is later rendered in another user’s browser. Successful exploitation could execute arbitrary JavaScript in the victim’s session when they view affected BSimVis pages, potentially allowing the attacker to perform actions as the victim, read data available to the victim, or alter displayed application content. This issue affects MISP bsimvis: through v0.2.0.
CVSS Scores
EPSS Scores
Probability:
Percentile:
Meta Information
Published
2026-06-10
Last Modified
2026-06-10
Generated
2026-06-10
AI Q&A
2026-06-10
EPSS Evaluated
N/A
NVD
CVE-2026-53693
EUVD
EUVD-2026-36051
Affected Vendors & Products
Showing 1 associated CPE
Vendor Product Version / Range
misp bsimvis to 0.2.0 (inc)
Helpful Resources
Exploitability
CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-79 The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.
CWE-116 The product prepares a structured message for communication with another component, but encoding or escaping of the data is either missing or done incorrectly. As a result, the intended structure of the message is not preserved.
Attack-Flow Graph
AI Quick Actions
Instant insights powered by AI
Executive Summary

This vulnerability is a stored cross-site scripting (XSS) issue in the MISP BSimVis tag rendering code. It occurs because several client-side rendering paths insert tag names, collection names, entity identifiers, cluster names, and tag metadata directly into HTML, HTML attributes, inline JavaScript event handlers, and CSS style values without proper escaping. This lack of context-appropriate escaping allows an attacker who can create or influence stored tag or metadata values to inject malicious JavaScript payloads that execute in other users' browsers when they view affected pages.

The vulnerability was addressed by adding shared escaping helpers for HTML, attributes, JavaScript strings, and CSS color validation, which were then applied across various UI components such as tag badges, tooltips, context menus, cluster cards, autocomplete suggestions, and dynamically inserted tag cards.

Impact Analysis

If exploited, this vulnerability allows an attacker to execute arbitrary JavaScript code in the context of a victim's browser session when they view affected BSimVis pages. This can enable the attacker to perform actions on behalf of the victim, read data accessible to the victim, or alter the content displayed by the application.

Mitigation Strategies

To mitigate this stored cross-site scripting vulnerability in MISP BSimVis, you should update the affected software to a version that includes the security patch.

The patch hardens stored XSS rendering paths by adding shared escaping helpers for HTML, attributes, JavaScript strings, and CSS color validation, which prevents injection of malicious scripts.

Specifically, apply the changes from the GitHub commit 7bcd2c2 in the MISP/bsimvis repository titled "Harden stored XSS rendering paths," which modifies tags.js and utils.js to fix the issue.

Compliance Impact

The provided information does not specify how the stored cross-site scripting vulnerability in MISP BSimVis affects compliance with common standards and regulations such as GDPR or HIPAA.

Chat Assistant
Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-53693. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70
EPSS Chart