CVE-2026-95659
Deferred Deferred - Pending Action

Reflected XSS in MISP AnalystDataController

Publication date: 2026-09-22

Last updated on: 2026-09-22

Assigner: CIRCL

Description
MISP contains a reflected cross-site scripting (XSS) vulnerability in the AnalystDataController::viewForObject action. The method accepted a parent object type parameter from the URL without validation and passed it to the Overmind-themed AnalystData thread view element, where it was interpolated into two translated strings and rendered into the HTML response without output encoding. An authenticated attacker who can induce a victim to navigate to a crafted URL can inject arbitrary JavaScript that executes in the victim's browser within the MISP application context. This may allow the attacker to read session data, manipulate the page, or perform actions on behalf of the victim.  The vulnerability requires the victim to be authenticated to MISP and to actively visit the attacker-supplied URL. The affected component is the AnalystData controller and the Overmind theme's AnalystData thread element. Version affected: <2.5.47

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-09-22
Last Modified
2026-09-22
Generated
2026-09-22
AI Q&A
2026-09-22
EPSS Evaluated
N/A
NVD
CVE-2026-95659
EUVD
EUVD-2026-84372

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
misp misp to 2.5.47 (exc)

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-116 The product prepares a structured message for communication with another component, but encoding or escaping of the data is either missing or done incorrectly. As a result, the intended structure of the message is not preserved.
CWE-20 The product receives input or data, but it does not validate or incorrectly validates that the input has the properties that are required to process the data safely and correctly.
CWE-79 The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This is a reflected cross-site scripting (XSS) vulnerability in MISP where an attacker can inject malicious JavaScript into a victim's browser by tricking them into visiting a crafted URL. The vulnerability occurs because the application accepts an unvalidated 'parent object type' parameter from the URL and renders it in the HTML response without proper output encoding.

Detection Guidance

To detect this vulnerability, inspect MISP instances for the affected component (AnalystData controller with Overmind theme) running versions below 2.5.47. Check for unusual JavaScript execution in the browser when accessing URLs with parent object type parameters. Review server logs for requests to the AnalystDataController::viewForObject action with unexpected parameters.

Impact Analysis

An attacker could exploit this to execute arbitrary JavaScript in your browser within the MISP application context. This may allow them to steal session data, manipulate the page you see, or perform actions on your behalf if you are authenticated to MISP and visit the malicious URL.

Compliance Impact

This vulnerability could potentially impact compliance with GDPR and HIPAA by enabling unauthorized access to sensitive data through XSS attacks. An attacker could exploit this to steal session data or manipulate pages, which may lead to data breaches or unauthorized actions. GDPR requires protection against unauthorized data access, while HIPAA mandates safeguards for protected health information. The vulnerability's exploitation could violate these requirements.

Mitigation Strategies

Immediately upgrade MISP to version 2.5.47 or later. If upgrading is not possible, apply the patch from the GitHub commit (23b879073) which validates the parent object type and escapes output. Restrict access to authenticated users only and monitor for suspicious activity in the AnalystData thread views.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-95659. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart