MISP TAXII Object Viewer Stored XSS via Unescaped JSON Output
MISP contains a cross-site scripting (XSS) vulnerability in the TAXII object viewer. When displaying a remote TAXII object, the JSON content of string properties was rendered directly into an HTML pre block without HTML-encoding. An attacker who can control or influence the content of a TAXII object (e.g., by publishing a malicious object to a TAXII server that the victim's MISP instance subscribes to) can inject arbitrary HTML or JavaScript that executes in the context of the victim's MISP session. Preconditions: - The victim must be an authenticated MISP user with access to the TAXII object viewer. - The victim must open or view the crafted TAXII object. Impact: - Execution of arbitrary JavaScript in the victim's browser within the MISP application context. - Potential theft of session tokens, API keys, or other sensitive data accessible from the MISP interface. - Potential for performing actions on behalf of the authenticated user. Affected versions: <2.5.48.
CVE-2026-104906
Primary source · Revision 1
Imported from structured advisory data. Source references identify upstream records or fields; verify affected versions and your deployed configuration.
Security context
Source reference: cve:CVE-2026-104906
MISP
Source reference: /containers/cna/affected/0/product
- Affected versions
- Not stated in this record
- Fixed versions
- Not stated in this record
- Prerequisites
- Not stated in this record
Structured affected-version data
Original package identities and version rules from this source.
[
{
"cpes": [
"cpe:2.3:a:misp:misp:*:*:*:*:*:*:*:*"
],
"repo": "https://github.com/MISP/MISP",
"vendor": "MISP",
"modules": [
"TAXII object viewer",
"app/View/Elements/genericElements/json.ctp"
],
"product": "MISP",
"versions": [
{
"status": "affected",
"version": "0",
"lessThan": "2.5.48",
"versionType": "semver"
}
],
"programFiles": [
"app/View/Elements/genericElements/json.ctp"
]
}
]- Related CVEs
- CVE-2026-104906
Source reference:
/cveMetadata/cveId
Publisher severity
medium
Source reference: /containers/cna/metrics
- Event
- #8025 · Revision 1
- Added to Heist Feed
- Publisher date