CVE-2026-103662: MISP Reflected XSS in Taxonomy Tag Confirmation Forms
MISP contains a reflected cross-site scripting (XSS) vulnerability in the legacy taxonomy tag management confirmation forms (add tag and disable tag).
The affected forms echoed a user-supplied tag name value from the request unescaped into the rendered HTML output. An attacker who can induce a site administrator to visit a crafted URL containing a malicious tag name parameter can execute arbitrary JavaScript in the administrator's browser session.
Preconditions:
- The target must be running a MISP instance with the legacy taxonomy tag confirmation views enabled.
- The victim must be an authenticated site administrator.
- The victim must navigate to the attacker-crafted URL (e.g., via a phishing link).
Security impact:
- Execution of arbitrary client-side script in the context of the administrator's browser.
- Potential theft of session tokens, CSRF tokens, or other sensitive data accessible from the page.
- Potential for performing privileged actions on behalf of the administrator within the MISP interface.
Affected versions: <2.5.48.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
MISPto a version that resolves this vulnerability.Fixed in 2.5.48
Event History
Frequently Asked Questions
Which deployments are exposed to this issue?
MISP versions earlier than 2.5.48 are affected only when the legacy taxonomy tag confirmation views are enabled. Exploitation also requires an authenticated site administrator to load an attacker-crafted URL.
Does an attacker need an account or direct access to the MISP instance?
No attacker authentication is described as necessary. The attacker must be able to persuade an authenticated site administrator to navigate to a crafted URL containing a malicious tag name parameter.
What could an attacker do if exploitation succeeds?
The attacker can execute JavaScript in the administrator's browser context. This may expose session or CSRF tokens and allow privileged actions to be performed through the MISP interface as that administrator.
What is the immediate mitigation if an upgrade is not possible?
Disable the legacy taxonomy tag confirmation views if they are enabled. Administrators should also avoid opening untrusted links to the MISP instance, since exploitation relies on navigating to a crafted URL.