Read the docs
TI-2026-76317 Aliases CVE-2026-112183GHSA-jj77-qm54-jjwq

MISP CSS Injection via Remote Tag Colour in Event Preview

Priority LOW 22CWE-74Published · Updated

Key facts

Attack vector
Network
Privileges required
Low
User interaction
Active
Attack complexity
Low
Attack requirements
None
Impact type
—
Confidentiality · integrity · availability
None · None · None
Fix status
Fixed

Attack profile from CVSS 4.0 · CNA. Fix status from CNA.

Summary

MISP versions before 2.5.48 contain a CSS injection flaw in the remote event preview feature. Each remote tag's colour value is written into an inline style attribute without sufficient validation, and HTML entity encoding does not stop it being read as CSS. An attacker who can create or modify tags on a linked server can supply a crafted colour that renders when a local user views the preview, enabling UI manipulation, visual spoofing or limited information disclosure through CSS techniques. Exploitation requires a linked server relationship and a victim who opens the preview page, and the weakness is classified as CWE-74.

Written with Claude Haiku 5.5 from the sources below · 2026-10-28

Description from the CNA

MISP contains a CSS injection vulnerability in the remote event preview feature. When a user previews an event from a linked MISP server, the colour value associated with each remote tag is written directly into an inline CSS style attribute without sufficient validation. Although HTML entity encoding is applied, the value is interpreted as CSS within the style attribute, allowing a malicious or compromised linked server to inject arbitrary CSS declarations. An attacker with the ability to create or modify tags on a linked MISP instance can craft a tag colour value containing CSS injection payloads. When a user on the local instance views the event preview, the injected CSS is rendered, potentially allowing UI manipulation, visual spoofing, or limited information disclosure through CSS-based techniques. Preconditions: - A linked MISP server relationship exists between the victim instance and the attacker-controlled instance. - The attacker can create or modify tags on the linked server. - A victim user views the remote event preview page. Affected: <2.5.48.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.00288 21st percentileScored 2026-11-07
Fix Fixed MISP (MISP): 2.5.48

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
None
Automatable
No
Technical impact
Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
MISPMISPbefore 2.5.482.5.48Patch availableCNA
  • MISP VendorMISP Affected before 2.5.48 Fixed in 2.5.48 Patch available CNA

CPE names CNA · 1

CPEVersionsRoleVendor
cpe:2.3:a:misp:misp:*:*:*:*:*:*:*:*——MISP
  • cpe:2.3:a:misp:misp:*:*:*:*:*:*:*:* Versions — — ·MISP

Remediation

Upgrade MISP to version 2.5.48 or later, which fixes the issue. The sources list no vendor advisory identifier for this fix.

Written with Claude Haiku 5.5 from the sources below · 2026-10-28

  • Fix · CNA MISP (MISP) Fixed in 2.5.48

Fixed in the same release

Records fixed by the same vendor advisory or release, as the CNA lists them.

  • Release ·

    MISP 2.5.48

    6 records Highest priority Priority LOW 6 LOW

    Other records, highest priority first

    • TI-2026-76319 MISP server settings lookup exposes configuration secretsPriority LOW 31
    • TI-2026-76314 Missing authorization in MISP proposal visibility exposes shadow attributesPriority LOW 31
    • TI-2026-76320 MISP leaks redacted module settings and lets users edit CLI-only onesPriority LOW 24
    Show all 6 records →

Timeline

  1. 2026-10-19 Threatist record created from CVE-2026-112183
  2. 2026-10-19 Alias added: GHSA-jj77-qm54-jjwq
  3. 2026-10-19 CISA SSVC decision points changed

References

Patch 1

  • TI-2025-41517 In MISP before 2.5.28, app/View/Elements/Workflows/executionPath.ctp allows XSS in the workflow execution path. CVSS 3.1CRITICAL 9.0
  • TI-2026-65744 MISP TOTP Code Replay Allows Duplicate Authentication Within Validity Period CVSS 4.0CRITICAL 9.3
  • TI-2026-54145 Path Traversal in MISP Object Template Resolution During STIX Import and Export in misp-stix library CVSS 4.0HIGH 8.8
  • TI-2020-10250 MISP MISP-maltego 1.4.4 incorrectly shares a MISP connection across users in a remote-transform use case. CVSS 3.1CRITICAL 9.8
  • TI-2026-59159 MISP Unauthenticated Mail Endpoints Allow Unbounded Storage Consumption and Request Flooding CVSS 4.0HIGH 8.7
  • TI-2026-58541 MISP LDAP and LinOTP Authentication Bypass via Empty or Invalid Credentials CVSS 4.0CRITICAL 9.5
See all 182 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences