CVE-2026-54395: MISP UiBeta event index reflected XSS in advanced filter popup
MISP contains a reflected cross-site scripting vulnerability in the UiBeta event index view. The urlparams value is inserted into an inline JavaScript handler using HTML escaping inside a single-quoted JavaScript string. Because browsers HTML-decode attribute values before JavaScript parsing, a crafted searcheventinfo value can restore encoded quote characters and break out of the JavaScript string. An attacker could craft a malicious URL that, when opened by a victim using the UiBeta event index, executes arbitrary JavaScript in the victim’s browser in the context of the MISP instance. The issue is fixed by encoding the value as a JavaScript string literal with jsonencode() before applying HTML escaping at the attribute layer.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Configuration
Encode the urlparams (searcheventinfo) value as a JavaScript string literal using json_encode(), then apply HTML escaping at the attribute layer before inserting into inline JavaScript handlers to prevent breaking out of the single-quoted JS string and mitigate reflected XSS.
MISP UiBeta event index view urlparams (searcheventinfo) encoding = encode as JavaScript string literal with json_encode() before HTML-escaping
Event History
Frequently Asked Questions
What is the severity of CVE-2026-54395?
CVE-2026-54395 has a medium severity rating of 5.3 according to the CVSS score.
How do I fix CVE-2026-54395?
To mitigate CVE-2026-54395, update MISP to the latest version where this vulnerability has been patched.
What type of vulnerability is CVE-2026-54395?
CVE-2026-54395 is identified as a reflected cross-site scripting (XSS) vulnerability.
In which software is CVE-2026-54395 found?
CVE-2026-54395 is found in MISP, the Malware Information Sharing Platform.
When was CVE-2026-54395 published?
CVE-2026-54395 was published on June 12, 2026.