CVE-2026-104907
Deferred Deferred - Pending Action

Stored XSS in MISP Event Preview

Publication date: 2026-10-02

Last updated on: 2026-10-02

Assigner: CIRCL

Description
MISP contains a cross-site scripting (XSS) vulnerability in the remote event preview page. When a linked (remote) MISP server is configured, the event preview renders tag identifiers inside an inline JavaScript onclick attribute. The tag ID value was HTML-escaped but not sanitized for the JavaScript string context, meaning a malicious linked server could supply a tag ID containing characters (such as a single quote) that break out of the JavaScript string literal and inject arbitrary script. Preconditions: - A linked/remote MISP server is configured and connected to the local instance. - The linked server supplies a crafted tag ID in an event. - An authenticated user views the event preview and interacts with the affected tag element. Impact: - Arbitrary JavaScript execution in the context of the viewing user's browser session, potentially allowing session hijacking, data exfiltration, or unauthorized actions on behalf of the user. Affected versions: MISP prior to the fix commit (v2.5.48 or later, exact boundary unconfirmed).

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-10-02
Last Modified
2026-10-02
Generated
2026-10-02
AI Q&A
2026-10-02
EPSS Evaluated
N/A
NVD
CVE-2026-104907
EUVD
EUVD-2026-91743

Affected Vendors & Products

Currently, no data is known.

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-116 The product prepares a structured message for communication with another component, but encoding or escaping of the data is either missing or done incorrectly. As a result, the intended structure of the message is not preserved.
CWE-79 The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This is a cross-site scripting (XSS) vulnerability in MISP where tag identifiers in remote event previews are rendered inside JavaScript onclick attributes. The tag ID is HTML-escaped but not sanitized for JavaScript context, allowing a malicious linked server to inject arbitrary script by breaking out of the string literal with characters like a single quote.

Detection Guidance

To detect this XSS vulnerability, inspect MISP event preview pages for remote events. Check if tag IDs are rendered unsafely in JavaScript onclick attributes. Review server logs for suspicious tag IDs containing quotes or JavaScript code. Use browser developer tools to examine rendered HTML and JavaScript execution during event preview.

Impact Analysis

An attacker could execute arbitrary JavaScript in your browser session when viewing a crafted event preview. This may lead to session hijacking, data theft, or unauthorized actions performed on your behalf if you are logged into MISP.

Mitigation Strategies

Upgrade MISP to version 2.5.48 or later to apply the security fix. If immediate upgrade is not possible, disable remote event preview functionality or restrict linked server connections. Review and sanitize all tag IDs from remote servers before rendering in event previews.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-104907. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart