CVE-2026-85230: MISP Dashboard Button Widget Allows Persistent JavaScript URL Injection
A persistent unsafe URL injection vulnerability exists in the MISP dashboard ButtonWidget configuration. Dashboard widget URLs were validated only when the widget was rendered and were not validated when the configuration was saved. As a result, an authenticated user able to modify dashboard widget settings could persist arbitrary URL values, including URLs using the javascript: scheme, through either of the dashboard settings persistence paths.
A malicious javascript: URL stored in a dashboard button could potentially result in client-side script execution in the MISP security context if the value reached a rendering or navigation path without the existing runtime validation. Such execution could allow an attacker to perform actions with the privileges of the affected user or access information available to their MISP session.
The practical exploitability of this issue is reduced by the fact that MISP already applied URL validation at render time, which neutralized known malicious values before they were presented to the user. The vulnerability therefore represents a persistence-layer validation gap and a defense-in-depth weakness rather than evidence of a direct bypass of the existing rendering protection.
The patch introduces a canonical url schema type and validates dashboard widget configuration before it is persisted through either settings save mechanism. ButtonWidget URLs must now be strings resolving to an absolute path on the current MISP instance or a full URL with the same origin. Values using javascript:, external origins, malformed URL forms, and non-string values are rejected at save time.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Configuration
Update/enable the ButtonWidget configuration persistence validation so that URLs are validated when the dashboard widget settings are saved (not only at render time). Enforce that ButtonWidget URLs must be strings resolving to an absolute path on the current MISP instance or a full URL with the same origin; reject javascript: URLs, external origins, malformed URL forms, and non-string values during the settings save process.
MISP Dashboard ButtonWidget ButtonWidget URL validation/persistence = Only accept strings resolving to an absolute path on the current MISP instance or a full URL with the same origin; reject javascript: scheme, external origins, malformed URL forms, and non-string values at save time
Event History
Frequently Asked Questions
Who can store a malicious dashboard button URL?
An authenticated MISP user who can modify dashboard widget settings can persist arbitrary URL values. The issue applies through both dashboard settings persistence paths.
Does saving a javascript: URL mean it will execute for dashboard users?
Not necessarily. Existing render-time URL validation neutralized known malicious values before they were presented, so the available information does not show a direct bypass of that protection.
What would the impact be if a stored value reached a rendering or navigation path without validation?
Client-side script could execute in the MISP security context. An attacker could then perform actions with the affected user's privileges or access information available to that user's MISP session.