CVE-2026-85227
Received Received - Intake

Reflected XSS in MISP Event Attribute Filtering

Publication date: 2026-09-03

Last updated on: 2026-09-03

Assigner: CIRCL

Description
MISP contains a reflected Cross-Site Scripting (XSS) vulnerability in the event attribute filtering query builder. The taggedAttributes and galaxyAttachedAttributes URL parameters were inserted into the query-builder rules without HTML escaping before being serialized as JSON and embedded inside a <script> element. Because JsonTool::encode() uses JSON_UNESCAPED_SLASHES, an attacker-controlled value containing a closing </script> sequence could terminate the surrounding script element and inject arbitrary HTML or JavaScript. For example, a specially crafted viewEventAttributes URL could contain malicious content in one of the affected filter parameters. An attacker could exploit the vulnerability by convincing an authenticated MISP user to follow a crafted URL. Successful exploitation would execute attacker-controlled JavaScript in the security context of the MISP instance and with the privileges of the victim's authenticated browser session. This could allow access to information available to the victim, modification of data through authenticated requests, or other actions permitted by the victim's MISP permissions. The vulnerability is addressed by applying HTML escaping with h() to both scalar and array values before they are inserted into the DOM.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-09-03
Last Modified
2026-09-03
Generated
2026-09-03
AI Q&A
2026-09-03
EPSS Evaluated
N/A
NVD
CVE-2026-85227
EUVD
EUVD-2026-70500

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
misp misp *

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-79 The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

MISP has a reflected Cross-Site Scripting (XSS) vulnerability in its event attribute filtering query builder. The taggedAttributes and galaxyAttachedAttributes URL parameters are inserted into query-builder rules without HTML escaping before being serialized as JSON and embedded inside a script element. This allows attackers to inject malicious JavaScript by terminating the script block prematurely.

Detection Guidance

Check MISP logs for unusual URL parameters containing script tags or event filtering queries with taggedAttributes or galaxyAttachedAttributes. Inspect network traffic for requests to /events/viewEventAttributes with suspicious payloads like </script><script>.

Impact Analysis

An attacker could exploit this by tricking an authenticated MISP user into clicking a crafted URL. Successful exploitation would execute attacker-controlled JavaScript in the victim's authenticated session, potentially allowing access to sensitive information, modification of data, or other actions permitted by the victim's MISP permissions.

Mitigation Strategies

Apply the patch from the MISP GitHub commit de51a16db to update the View/eventFilteringQueryBuilder.ctp file. Ensure the h() escaping function is applied to taggedAttributes and galaxyAttachedAttributes parameters before DOM insertion.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-85227. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart