CVE-2026-103321: MISP Stored Cross-Site Scripting (XSS) via Unvalidated Event Graph Preview Image
MISP contains a stored cross-site script (XSS) vulnerability in the event graph preview feature.
The event graph preview image field was accepted and stored without server-side validation. On the client side, the stored value was rendered into an HTML img element's src attribute via string concatenation, allowing a crafted value to break out of the attribute context and inject arbitrary script.
Preconditions:
- An authenticated MISP user with the ability to create or modify an event graph entry.
- A second user (the victim) who views the event graph and triggers the preview popover.
Impact:
- Execution of arbitrary JavaScript in the victim's browser within the MISP application context.
- Potential theft of session tokens, cookies, or sensitive data accessible to the victim's browser.
- Potential for performing actions on behalf of the victim within the MISP application.
Affected: MISP versions prior to the fix (commit applied after v2.5.48).
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Configuration
Enforce strict server-side validation so the preview image field accepts only a well-formed base64-encoded PNG data URL.
MISP event graph preview image field server-side validation = well-formed base64-encoded PNG data URL only - Configuration
Replace client-side string-concatenation rendering with DOM-based attribute assignment so the preview image value is not interpreted as HTML.
MISP event graph preview rendering img src assignment = DOM-based attribute assignment
Event History
Frequently Asked Questions
Who can exploit this issue, and who is at risk?
An authenticated MISP user who can create or modify an event graph entry can store a crafted preview image value. Users are exposed when they view that event graph and trigger its preview popover.
What access or interaction is required for exploitation?
The attacker needs authenticated access with permission to create or modify an event graph entry. The victim must view the affected event graph and trigger the preview popover for the injected JavaScript to execute.
What could an attacker do in a victim's browser?
The attacker can execute arbitrary JavaScript in the MISP application context of the victim. This may allow theft of session tokens, cookies, or browser-accessible sensitive data, and actions performed as the victim.
Which versions are affected?
MISP versions before the fix commit applied after v2.5.48 are affected. The provided fix reference is commit 92c7ccc43.