CVE-2026-112183: MISP CSS Injection via Remote Tag Colour in Event Preview
MISP contains a CSS injection vulnerability in the remote event preview feature. When a user previews an event from a linked MISP server, the colour value associated with each remote tag is written directly into an inline CSS style attribute without sufficient validation. Although HTML entity encoding is applied, the value is interpreted as CSS within the style attribute, allowing a malicious or compromised linked server to inject arbitrary CSS declarations.
An attacker with the ability to create or modify tags on a linked MISP instance can craft a tag colour value containing CSS injection payloads. When a user on the local instance views the event preview, the injected CSS is rendered, potentially allowing UI manipulation, visual spoofing, or limited information disclosure through CSS-based techniques.
Preconditions:
- A linked MISP server relationship exists between the victim instance and the attacker-controlled instance.
- The attacker can create or modify tags on the linked server.
- A victim user views the remote event preview page.
Affected: <2.5.48.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
MISPto a version that resolves this vulnerability.Fixed in 2.5.48
Event History
Frequently Asked Questions
Which deployments are exposed to this issue?
Exposure requires a linked MISP server relationship with an attacker-controlled or compromised remote instance. The local instance is affected when a user can open remote event previews and the remote side can supply tag colour values.
What access does an attacker need?
The attacker needs the ability to create or modify tags on the linked MISP instance. They do not need access to the local instance, but a local user must view the remote event preview for the payload to render.
What is the practical impact of exploitation?
The injected value is interpreted as CSS, allowing arbitrary CSS declarations in the preview. This can support UI manipulation, visual spoofing, and limited information disclosure using CSS-based techniques.
How can I identify potentially affected instances?
MISP versions earlier than 2.5.48 are affected. Prioritize instances that have linked remote MISP servers and whose users view remote event previews, especially where remote tag creation or modification is not fully trusted.