CVE-2026-86440: MISP Dashboard Button Widget Allows Stored XSS via Unsafe javascript: and Backslash URLs
Affected versions of MISP insufficiently validate URLs used by dashboard widgets, particularly the Button widget.
The widget's URL is stored configuration controlled by a user. The previous renderer considered a URL safe if it appeared relative or if its parsed hostname matched the configured MISP hostname. That logic failed to reject dangerous schemes and URL forms that browsers normalize differently from PHP's URL parsing.
As a result, values such as javascript: URLs or backslash-based authority forms could reach the generated anchor's href and execute script or navigate to an attacker-controlled origin when another user interacted with the widget. The upstream commit describes the issue as:
“javascript: and backslash URLs reached the href (stored XSS)”.
The fix routes widget URLs through a shared DashboardURLValidator, rejects dangerous schemes, raw backslashes, control characters, and unauthorized absolute origins, and validates the URL both in the widget handler and renderer.
Version affected: ≤2.5.45
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
MISP Dashboard Button Widgetto a version that resolves this vulnerability.Fixed in 2.5.45
Event History
Frequently Asked Questions
Who can exploit this issue in practice?
A user who can control the stored URL configuration of a dashboard Button widget can supply a malicious URL. Exploitation occurs when another user interacts with the rendered widget.
Are default deployments affected?
The issue affects MISP versions 2.5.45 and earlier where users can configure Button-widget URLs. The provided information does not establish whether all users have that configuration capability by default.
What URL patterns should be treated as indicators of exposure?
Review stored dashboard widget URLs for javascript: schemes and backslash-based authority forms. The fix also rejects raw backslashes, control characters, dangerous schemes, and absolute URLs pointing to origins not authorized by the configured MISP hostname.
What is the remediation?
Upgrade to a version containing the upstream fix, which uses DashboardURLValidator and validates URLs in both the widget handler and renderer. Until then, remove or correct suspicious Button-widget URL values and restrict who can modify widget configuration.