CVE-2026-94373: MISP DOM-based Cross-Site Scripting via innerHTML in Contextual Menu
MISP contains a DOM-based cross-site scripting (XSS) vulnerability in the contextual menu JavaScript component. The ContextualMenu class populates HTML <option> elements by assigning user-controllable values to the innerHTML property. Because innerHTML parses and renders HTML markup, any untrusted string supplied as the option text (value.text or value) is interpreted as live DOM content rather than plain text. An attacker who can influence the data rendered in the contextual menu can inject arbitrary HTML or JavaScript that executes in the victim's browser within the MISP application origin. This may allow session hijacking, data exfiltration, or unauthorized actions performed on behalf of the authenticated user.
Version affected: <2.5.47
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Configuration
In ContextualMenu, when populating dynamically created <option> elements, replace the unsafe innerHTML property assignments used for user-controllable option text (value.text or value) with the safe textContent property so injected HTML/JavaScript is not interpreted.
MISP contextual menu JavaScript (ContextualMenu class) innerHTML -> textContent for dynamic <option> display text = Replace assignments to innerHTML (e.g., option.innerHTML = ...) with textContent (e.g., option.textContent = ...).
Event History
Frequently Asked Questions
Who is exposed to this issue?
MISP deployments running versions earlier than 2.5.47 are affected when a user views a contextual menu containing attacker-controlled option text. The JavaScript executes in the browser of the authenticated user viewing that menu.
What does an attacker need to exploit it?
The attacker needs the ability to influence data rendered as option text in the contextual menu, through either value.text or value. They do not need to inject code directly into the menu component itself; the vulnerable innerHTML assignment interprets supplied markup as DOM content.
What is the practical impact of successful exploitation?
Injected HTML or JavaScript runs under the MISP application origin in the victim's browser. This can enable session hijacking, data exfiltration, or actions performed with the victim's authenticated privileges.
How can I determine whether my deployment needs remediation?
Check the deployed MISP version. Versions earlier than 2.5.47 are affected; deployments at or above that version are not identified as affected by the provided information.