CVE-2026-104906: MISP TAXII Object Viewer Stored XSS via Unescaped JSON Output
MISP contains a cross-site scripting (XSS) vulnerability in the TAXII object viewer. When displaying a remote TAXII object, the JSON content of string properties was rendered directly into an HTML pre block without HTML-encoding. An attacker who can control or influence the content of a TAXII object (e.g., by publishing a malicious object to a TAXII server that the victim's MISP instance subscribes to) can inject arbitrary HTML or JavaScript that executes in the context of the victim's MISP session.
Preconditions:
- The victim must be an authenticated MISP user with access to the TAXII object viewer.
- The victim must open or view the crafted TAXII object.
Impact:
- Execution of arbitrary JavaScript in the victim's browser within the MISP application context.
- Potential theft of session tokens, API keys, or other sensitive data accessible from the MISP interface.
- Potential for performing actions on behalf of the authenticated user.
Affected versions: <2.5.48.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
MISPto a version that resolves this vulnerability.Fixed in 2.5.48
Event History
Frequently Asked Questions
Who is exposed to exploitation?
Authenticated MISP users who can access the TAXII object viewer are exposed if they open a crafted remote TAXII object. Instances are at risk when they subscribe to TAXII content that an attacker can control or influence.
What does an attacker need to exploit this issue?
The attacker needs to control or influence a TAXII object's string-property content, such as by publishing a malicious object on a TAXII server used by the victim's MISP instance. They must also induce an authenticated user to view that object in the TAXII object viewer.
How can we determine whether our instance is affected?
MISP versions earlier than 2.5.48 are affected. Exposure also requires use of the TAXII object viewer and viewing remote TAXII objects containing attacker-controlled content.
What is the likely impact if exploitation succeeds?
Malicious HTML or JavaScript can execute in the authenticated user's MISP browser session. This may allow theft of session tokens, API keys, or other data accessible through the interface, or actions performed as that user.