CVE-2026-95661
Deferred Deferred - Pending Action

Reflected XSS in MISP Attribute Histogram View

Publication date: 2026-09-22

Last updated on: 2026-09-22

Assigner: CIRCL

Description
MISP contains a reflected cross-site scripting (XSS) vulnerability in the attribute histogram view. The $selectedTypes variable, which is derived from the URL path segment , was interpolated directly into a JavaScript array literal inside an onClick HTML attribute without any encoding or escaping. An attacker who can cause an authenticated MISP user to visit a crafted URL containing a malicious type value can execute arbitrary JavaScript in the victim's browser within the MISP application origin. Successful exploitation allows the attacker to read session cookies, perform actions on behalf of the victim, or exfiltrate sensitive data accessible from the MISP interface.  The vulnerability requires the victim to be authenticated and to actively navigate to the attacker-supplied URL.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-09-22
Last Modified
2026-09-22
Generated
2026-09-22
AI Q&A
2026-09-22
EPSS Evaluated
N/A
NVD
CVE-2026-95661
EUVD
EUVD-2026-84374

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
misp misp *

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-79 The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This is a reflected cross-site scripting (XSS) vulnerability in MISP. It occurs in the attribute histogram view where user-supplied input from the URL is directly inserted into JavaScript code without proper encoding. This allows an attacker to inject malicious scripts that execute in the victim's browser when they visit a crafted URL.

Detection Guidance

To detect this vulnerability, inspect the MISP application for the attribute histogram view. Look for direct URL-supplied input being echoed into JavaScript without proper escaping. Check the histogram.ctp file for unsanitized output in onClick handlers.

Impact Analysis

An attacker could exploit this to read your session cookies, perform actions on your behalf within MISP, or steal sensitive data visible in the MISP interface. The attack requires you to be authenticated and click a malicious link.

Compliance Impact

This vulnerability could lead to unauthorized access to sensitive data, potentially violating GDPR's data protection requirements and HIPAA's safeguards for protected health information. The XSS flaw allows attackers to steal session cookies or exfiltrate data, which may result in unauthorized data processing or disclosure.

Mitigation Strategies

Apply the patch from the MISP repository commit 95b8f21f6. Ensure all user-supplied input in the attribute histogram view is properly escaped using the h() function before rendering in JavaScript contexts.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-95661. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart