CVE-2026-88921: MISP: Unescaped HTML Injection in PDF Report Element Rendering
MISP contains an HTML injection vulnerability in the MISPElementHTMLFormatterTool component, which is responsible for rendering MISP element references (attributes, objects, and tags) into inline HTML during PDF report export via the convertmarkdowntopdf module. The attribute(), objectAttribute(), object(), and tag() methods interpolated user-controlled fields (attribute type, attribute value, object name, object relation, tag name, tag colour, and tag text colour) directly into HTML templates without applying HTML entity encoding. An authenticated user with the ability to create or modify MISP attributes, objects, or tags could embed arbitrary HTML markup in these fields. When a report containing such elements was exported to PDF, the unescaped content was rendered as live HTML rather than inert text, potentially injecting script tags, breaking the document structure, or altering the visual content of the exported report. Additionally, the attribute() method contained a template with hardcoded sample values ("domain-ip" and "google.com") instead of format placeholders, meaning every plain attribute reference in a PDF displayed the sample text rather than the actual indicator value, constituting a data-integrity defect in the exported document. The vulnerability requires an authenticated actor with write access to MISP elements and a subsequent PDF export of a report referencing those elements. The security impact is primarily to the integrity of the exported document and, depending on the HTML-to-PDF rendering engine, potential execution of injected markup during the conversion step.
Version affected: ≤2.5.45
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
MISP (MISPElementHTMLFormatterTool)to a version that resolves this vulnerability.Fixed in 2.5.45 - Configuration
Replace the attribute() method’s hardcoded sample values in its HTML template with proper %s format placeholders so exported PDFs render the actual element data.
MISPElementHTMLFormatterTool attribute() template placeholders = Use %s format placeholders instead of hardcoded sample values (e.g., "domain-ip" and "google.com") - Configuration
In the HTML templates used by attribute(), objectAttribute(), object(), and tag() methods, apply HTML entity encoding via the h() helper to every user-controlled field interpolated: attribute type, attribute value, object name, object relation, tag name, tag colour, and tag text colour.
MISPElementHTMLFormatterTool HTML entity encoding of user-controlled fields = Apply h() (htmlspecialchars with ENT_QUOTES and UTF-8) to interpolated values
Event History
Frequently Asked Questions
Who can exploit this issue?
An authenticated user who can create or modify MISP attributes, objects, or tags can supply malicious HTML through affected fields. The issue is triggered when a report containing those elements is exported to PDF.
Which fields may carry injected HTML?
Affected user-controlled fields include attribute type and value, object name and relation, and tag name, colour, and text colour. These values were inserted into HTML templates without HTML entity encoding.
What is the impact on exported reports?
Injected markup can be rendered as live HTML during PDF export, which can alter report content, break document structure, or potentially inject script tags. The affected rendering path is the convert_markdown_to_pdf module.
Is there a separate PDF rendering correctness issue?
Yes. Plain attribute references could display the hardcoded sample values "domain-ip" and "google.com" rather than the actual indicator, due to a template lacking format placeholders.