CVE-2026-94372
Deferred Deferred - Pending Action

Stored XSS in MISP Default Theme Galaxies Index

Publication date: 2026-09-21

Last updated on: 2026-09-21

Assigner: CIRCL

Description
MISP contains a stored cross-site scripting (XSS) vulnerability in the default theme's Galaxies index page. When a MISP instance detects unknown custom or default galaxy clusters during synchronization, it renders sample tag names in an informational notice directed at site administrators. In the default theme, these sample tag names were inserted into the HTML output without HTML-entity encoding. A user with tag-editor privileges could craft a malicious misp-galaxy tag containing arbitrary script. When a site administrator subsequently viewed the Galaxies index page, the crafted tag content was interpreted as executable markup in the administrator's browser session, enabling the attacker to read session data, perform actions on behalf of the administrator, or otherwise compromise the administrator's browser context. The Overmind theme already applied HTML escaping to the same values and was not affected. The vulnerability requires the attacker to possess tag-editor-level access to create the crafted tag and requires the victim (a site administrator) to view the Galaxies index page in the default theme. The impact is limited to the administrator's browser session and does not directly compromise the MISP server process. Version affected: <2.5.47

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-09-21
Last Modified
2026-09-21
Generated
2026-09-21
AI Q&A
2026-09-21
EPSS Evaluated
N/A
NVD
CVE-2026-94372
EUVD
EUVD-2026-83900

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
misp misp to 2.5.47 (exc)

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-79 The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This is a stored cross-site scripting (XSS) vulnerability in MISP's default theme. It occurs when unknown galaxy-cluster tag names are not properly escaped in the Galaxies index page. An attacker with tag-editor privileges can create a malicious tag containing script code. When a site administrator views the Galaxies index page, the script executes in their browser, potentially allowing the attacker to steal session data or perform actions on the administrator's behalf.

Detection Guidance

Check MISP version with: misp --version. If version is below 2.5.47, the system is vulnerable. Inspect Galaxies index page HTML output for unescaped tag names in admin notices.

Impact Analysis

If you are a site administrator using the default theme, an attacker with tag-editor access could exploit this to run malicious scripts in your browser. This may lead to session hijacking, unauthorized actions performed as you, or exposure of sensitive data. The impact is limited to your browser session and does not directly compromise the MISP server.

Compliance Impact

This vulnerability could lead to unauthorized access to sensitive data, which may violate GDPR (data protection) or HIPAA (health information privacy) requirements. Organizations using MISP must ensure proper security controls are in place to prevent such breaches, as unauthorized data exposure could result in regulatory penalties or legal consequences.

Mitigation Strategies

Upgrade MISP to version 2.5.47 or later. If using default theme, ensure HTML escaping is applied to galaxy tag names in admin notices. Review user permissions to limit tag-editor access.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-94372. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart