CVE-2026-94277
Deferred Deferred - Pending Action

Stored Cross-Site Scripting in MISP Galaxy Matrix Statistics

Publication date: 2026-09-21

Last updated on: 2026-09-21

Assigner: CIRCL

Description
MISP's galaxy matrix statistics view (app/View/Users/statistics_galaxymatrix.ctp) renders the galaxy name directly into HTML output via sprintf() without any HTML encoding. An authenticated user holding the perm_galaxy_editor permission can create or modify a galaxy whose name contains arbitrary HTML or JavaScript markup. Because the value is interpolated verbatim into the page, any user who subsequently opens the galaxy matrix statistics page will have the embedded script executed in their browser context. This enables session hijacking, credential theft, data exfiltration, or the performance of arbitrary actions on behalf of the victim within the MISP application. Version affected: <2.5.47

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-09-21
Last Modified
2026-09-21
Generated
2026-09-21
AI Q&A
2026-09-21
EPSS Evaluated
N/A
NVD
CVE-2026-94277
EUVD
EUVD-2026-83879

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
misp misp to 2.5.47 (exc)

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-79 The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This is a cross-site scripting (XSS) vulnerability in MISP where an authenticated user with the perm_galaxy_editor permission can inject malicious HTML or JavaScript into a galaxy name. The injected code executes in the browser of any user viewing the galaxy matrix statistics page, potentially leading to session hijacking, credential theft, or data exfiltration.

Detection Guidance

Check MISP versions below 2.5.47 for the galaxy matrix statistics page. Inspect galaxy names for HTML or JavaScript content in the statistics view. Review user permissions for perm_galaxy_editor role.

Impact Analysis

If you are a user of a vulnerable MISP instance, visiting the galaxy matrix statistics page could result in arbitrary scripts running in your browser. This may allow attackers to steal your session cookies, login credentials, or sensitive data, or perform actions on your behalf within MISP.

Compliance Impact

This vulnerability could lead to unauthorized access to personal or sensitive data, violating GDPR's data protection principles or HIPAA's security requirements. Organizations may face compliance violations, legal penalties, or reputational damage if exploited.

Mitigation Strategies

Upgrade MISP to version 2.5.47 or later. Apply the fix from the GitHub commit 6b7637bf4 which escapes galaxy names using the h() function before HTML output.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-94277. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart