Read the docs
TI-2026-66148 Aliases CVE-2026-104906GHSA-x6q8-3wfm-g2w6

MISP TAXII Object Viewer Stored XSS via Unescaped JSON Output

Priority LOW 28CWE-79Published · Updated

Key facts

Attack vector
Network
Privileges required
Low
User interaction
Active
Attack complexity
Low
Attack requirements
None
Impact type
Cross-site scripting
Confidentiality · integrity · availability
None · None · None
Fix status
Fixed

Attack profile from CVSS 4.0 · CNA. Fix status from CNA. Impact type from CWE-79.

Summary

MISP contains a cross-site scripting (XSS) vulnerability in the TAXII object viewer. When displaying a remote TAXII object, the JSON content of string properties was rendered directly into an HTML pre block without HTML-encoding. An attacker who can control or influence the content of a TAXII object (e.g., by publishing a malicious object to a TAXII server that the victim's MISP instance subscribes to) can inject arbitrary HTML or JavaScript that executes in the context of the victim's MISP session. Preconditions: - The victim must be an authenticated MISP user with access to the TAXII object viewer. - The victim must open or view the crafted TAXII object. Impact: - Execution of arbitrary JavaScript in the victim's browser within the MISP application context. - Potential theft of session tokens, API keys, or other sensitive data accessible from the MISP interface. - Potential for performing actions on behalf of the authenticated user. Affected versions: <2.5.48.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.0036 29th percentileScored 2026-11-07
Fix Fixed MISP (MISP): 2.5.48

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
None
Automatable
No
Technical impact
Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
MISPMISPbefore 2.5.482.5.48Patch availableCNA
  • MISP VendorMISP Affected before 2.5.48 Fixed in 2.5.48 Patch available CNA

CPE names CNA · 1

CPEVersionsRoleVendor
cpe:2.3:a:misp:misp:*:*:*:*:*:*:*:*——MISP
  • cpe:2.3:a:misp:misp:*:*:*:*:*:*:*:* Versions — — ·MISP

Remediation

  • Fix · CNA MISP (MISP) Fixed in 2.5.48

Fixed in the same release

Records fixed by the same vendor advisory or release, as the CNA lists them.

  • Release ·

    MISP 2.5.48

    8 records Highest priority Priority LOW 8 LOW

    Other records, highest priority first

    • TI-2026-66152 MISP Correlation Authorization Bypass Exposes Restricted Event and Attribute DataPriority LOW 31
    • TI-2026-66150 MISP Decaying Model Import Mass Assignment Allows Cross-Organization Model Overwrite and Default FlaggingPriority LOW 31
    • TI-2026-66151 MISP Information Disclosure via Related Events Listing Bypassing Per-Event AuthorizationPriority LOW 24
    Show all 8 records →

Timeline

  1. 2026-10-02 Threatist record created from CVE-2026-104906
  2. 2026-10-03 Alias added: GHSA-x6q8-3wfm-g2w6

References

Patch 1

  • TI-2025-41517 In MISP before 2.5.28, app/View/Elements/Workflows/executionPath.ctp allows XSS in the workflow execution path. CVSS 3.1CRITICAL 9.0
  • TI-2026-65744 MISP TOTP Code Replay Allows Duplicate Authentication Within Validity Period CVSS 4.0CRITICAL 9.3
  • TI-2026-54145 Path Traversal in MISP Object Template Resolution During STIX Import and Export in misp-stix library CVSS 4.0HIGH 8.8
  • TI-2020-10250 MISP MISP-maltego 1.4.4 incorrectly shares a MISP connection across users in a remote-transform use case. CVSS 3.1CRITICAL 9.8
  • TI-2026-59159 MISP Unauthenticated Mail Endpoints Allow Unbounded Storage Consumption and Request Flooding CVSS 4.0HIGH 8.7
  • TI-2026-58541 MISP LDAP and LinOTP Authentication Bypass via Empty or Invalid Credentials CVSS 4.0CRITICAL 9.5
See all 182 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences