CVE-2026-112184: MISP Workflow Module: Reflected XSS via Unescaped misp-modules Parameter Names in Form Labels
MISP contains a reflected cross-site scripting (XSS) vulnerability in the workflow module interface. Parameter names returned by the misp-modules service are rendered as raw HTML form labels on the workflow module page without output encoding. An attacker who can influence the parameter names reported by the misp-modules service can inject arbitrary HTML or JavaScript that executes in the context of an authenticated MISP user's browser.
Preconditions:
- The attacker must be able to control or influence parameter names reported by the misp-modules service.
- A victim must be authenticated and view the affected workflow module page.
Impact:
- Execution of arbitrary JavaScript in the victim's browser session.
- Potential theft of session tokens, manipulation of the MISP interface, or initiation of unauthorized actions on behalf of the victim.
Affected versions: <2.5.48.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
MISPto a version that resolves this vulnerability.Fixed in 2.5.48
Event History
Frequently Asked Questions
Who is exposed to this issue?
MISP instances running versions earlier than 2.5.48 are affected when their workflow module interface uses a misp-modules service whose reported parameter names an attacker can control or influence. Exploitation also requires an authenticated user to open the affected workflow module page.
What does an attacker need to exploit it?
The attacker must be able to control or influence parameter names returned by the misp-modules service. They must then cause an authenticated MISP user to view the workflow module page where those names are rendered as form labels.
What could happen if exploitation succeeds?
Arbitrary HTML or JavaScript can execute in the authenticated user's MISP browser context. This may permit session-token theft, MISP interface manipulation, or unauthorized actions performed as that user.
How can I determine whether my deployment is affected?
Check whether the MISP version is earlier than 2.5.48 and whether workflow modules render parameter names supplied by misp-modules. Assess whether untrusted parties can control or influence the parameter names returned by that service.