CVE-2026-85227: Reflected Cross-Site Scripting in MISP Event Filtering via taggedAttributes and galaxyAttachedAttributes Parameters
MISP contains a reflected Cross-Site Scripting (XSS) vulnerability in the event attribute filtering query builder. The taggedAttributes and galaxyAttachedAttributes URL parameters were inserted into the query-builder rules without HTML escaping before being serialized as JSON and embedded inside a <script> element.
Because JsonTool::encode() uses JSONUNESCAPEDSLASHES, an attacker-controlled value containing a closing </script> sequence could terminate the surrounding script element and inject arbitrary HTML or JavaScript. For example, a specially crafted viewEventAttributes URL could contain malicious content in one of the affected filter parameters.
An attacker could exploit the vulnerability by convincing an authenticated MISP user to follow a crafted URL. Successful exploitation would execute attacker-controlled JavaScript in the security context of the MISP instance and with the privileges of the victim's authenticated browser session. This could allow access to information available to the victim, modification of data through authenticated requests, or other actions permitted by the victim's MISP permissions.
The vulnerability is addressed by applying HTML escaping with h() to both scalar and array values before they are inserted into the DOM.
Affected Software
Event History
Frequently Asked Questions
Does exploitation require the attacker to authenticate to MISP?
The described attack relies on convincing an authenticated MISP user to open a crafted viewEventAttributes URL. The attacker-controlled script then runs in that user's authenticated browser session.
Which users are most exposed?
Any authenticated user who can be induced to follow a malicious URL is exposed. The consequences are limited by the permissions available to that victim's MISP session.
What is required to remediate the issue?
Apply the fix that HTML-escapes the affected parameter values with h() before they are embedded in the script context. The referenced upstream change is commit de51a16db.