CVE-2026-53693: MISP BSimVis stored cross-site scripting in tag and cluster rendering paths via unescaped tag metadata and UI labels
A stored cross-site scripting vulnerability existed in MISP BSimVis tag rendering code. Several client-side rendering paths interpolated tag names, collection names, entity identifiers, cluster names, and tag metadata directly into HTML, HTML attributes, inline JavaScript event handlers, and CSS style values without context-appropriate escaping. The patch adds shared escaping helpers for HTML, attributes, JavaScript strings, and CSS color validation, then applies them across tag badges, tooltips, context menus, cluster cards, autocomplete suggestions, and dynamically inserted tag cards.
An attacker able to create or influence stored tag or metadata values could inject a crafted payload that is later rendered in another user’s browser. Successful exploitation could execute arbitrary JavaScript in the victim’s session when they view affected BSimVis pages, potentially allowing the attacker to perform actions as the victim, read data available to the victim, or alter displayed application content.
This issue affects MISP bsimvis: through v0.2.0.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Remove
Remove
MISP bsimvisfrom your environment.Uninstall or disable the MISP BSimVis component/plugin if it is not required to remove the vulnerable rendering code from the environment.
- Compensating control
Restrict who can create or modify tags and tag metadata to trusted administrators only; restrict access to BSimVis pages (for example, via network ACLs, IP allowlists, VPN, or firewall rules) to reduce the chance that untrusted users can store malicious tag values.
- Operational
Audit existing stored tags, tag metadata, collection names, cluster names, and other UI labels for suspicious or unescaped content; sanitize or remove any malicious or untrusted values. After remediation, consider clearing relevant caches and informing affected users to reload pages.
Event History
Frequently Asked Questions
What is the severity of CVE-2026-53693?
CVE-2026-53693 has a risk score of 45, indicating it poses a moderate severity threat.
How do I fix CVE-2026-53693?
To fix CVE-2026-53693, update the MISP BSimVis software to the latest version where the vulnerability has been patched.
What type of vulnerability is CVE-2026-53693?
CVE-2026-53693 is classified as a stored cross-site scripting (XSS) vulnerability.
What are the potential impacts of CVE-2026-53693?
If exploited, CVE-2026-53693 could allow attackers to execute arbitrary JavaScript in users' browsers, leading to data theft or session hijacking.
In which software is CVE-2026-53693 found?
CVE-2026-53693 exists in the MISP BSimVis software, specifically in its tag rendering code.