CVE-2026-112184: MISP Workflow Module: Reflected XSS via Unescaped misp-modules Parameter Names in Form Labels

Q: Who is exposed to this issue?

MISP instances running versions earlier than 2.5.48 are affected when their workflow module interface uses a misp-modules service whose reported parameter names an attacker can control or influence. Exploitation also requires an authenticated user to open the affected workflow module page.

Q: What could happen if exploitation succeeds?

Arbitrary HTML or JavaScript can execute in the authenticated user's MISP browser context. This may permit session-token theft, MISP interface manipulation, or unauthorized actions performed as that user.

Q: How can I determine whether my deployment is affected?

Check whether the MISP version is earlier than 2.5.48 and whether workflow modules render parameter names supplied by misp-modules. Assess whether untrusted parties can control or influence the parameter names returned by that service.

Published Oct 19, 2026

Updated

MISP contains a reflected cross-site scripting (XSS) vulnerability in the workflow module interface. Parameter names returned by the misp-modules service are rendered as raw HTML form labels on the workflow module page without output encoding. An attacker who can influence the parameter names reported by the misp-modules service can inject arbitrary HTML or JavaScript that executes in the context of an authenticated MISP user's browser.

Preconditions:

- The attacker must be able to control or influence parameter names reported by the misp-modules service.

- A victim must be authenticated and view the affected workflow module page.

Impact:

- Execution of arbitrary JavaScript in the victim's browser session.

- Potential theft of session tokens, manipulation of the MISP interface, or initiation of unauthorized actions on behalf of the victim.

Affected versions: <2.5.48.

Affected Software

1 affected component

Misp Misp<2.5.48

Remediation

Recommended actions to resolve this vulnerability, in priority order.

Upgrade
Upgrade MISP to a version that resolves this vulnerability.
Fixed in 2.5.48

Event History

Oct 19, 2026

CVE Published

via MITRE·09:19 AM

Data Sourced

via MITRE·09:19 AM

RemedyDescriptionWeakness

Data Sourced

via NVD·10:16 AM

DescriptionSeverityWeakness

Frequently Asked Questions

Who is exposed to this issue?

MISP instances running versions earlier than 2.5.48 are affected when their workflow module interface uses a misp-modules service whose reported parameter names an attacker can control or influence. Exploitation also requires an authenticated user to open the affected workflow module page.

What does an attacker need to exploit it?

The attacker must be able to control or influence parameter names returned by the misp-modules service. They must then cause an authenticated MISP user to view the workflow module page where those names are rendered as form labels.

What could happen if exploitation succeeds?

Arbitrary HTML or JavaScript can execute in the authenticated user's MISP browser context. This may permit session-token theft, MISP interface manipulation, or unauthorized actions performed as that user.

How can I determine whether my deployment is affected?

Check whether the MISP version is earlier than 2.5.48 and whether workflow modules render parameter names supplied by misp-modules. Assess whether untrusted parties can control or influence the parameter names returned by that service.

CVE-2026-112184: MISP Workflow Module: Reflected XSS via Unescaped misp-modules Parameter Names in Form Labels

Affected Software

Remediation

Event History

Frequently Asked Questions

Who is exposed to this issue?

What does an attacker need to exploit it?

What could happen if exploitation succeeds?

How can I determine whether my deployment is affected?

Company

Resources

Contact

Frequently Asked Questions

Who is exposed to this issue?

What does an attacker need to exploit it?

What could happen if exploitation succeeds?

How can I determine whether my deployment is affected?