← Back to CVE List
CVE-2026-104906NVD
Vulnerability Summary
MISP contains a cross-site scripting (XSS) vulnerability in the TAXII object viewer. When displaying a remote TAXII object, the JSON content of string properties was rendered directly into an HTML pre block without HTML-encoding. An attacker who can control or influence the content of a TAXII object (e.g., by publishing a malicious object to a TAXII server that the victim's MISP instance subscribes to) can inject arbitrary HTML or JavaScript that executes in the context of the victim's MISP session.
Preconditions:
- The victim must be an authenticated MISP user with access to the TAXII object viewer.
- The victim must open or view the crafted TAXII object.
Impact:
- Execution of arbitrary JavaScript in the victim's browser within the MISP application context.
- Potential theft of session tokens, API keys, or other sensitive data accessible from the MISP interface.
- Potential for performing actions on behalf of the authenticated user.
Affected versions: <2.5.48.
Preconditions:
- The victim must be an authenticated MISP user with access to the TAXII object viewer.
- The victim must open or view the crafted TAXII object.
Impact:
- Execution of arbitrary JavaScript in the victim's browser within the MISP application context.
- Potential theft of session tokens, API keys, or other sensitive data accessible from the MISP interface.
- Potential for performing actions on behalf of the authenticated user.
Affected versions: <2.5.48.
CVSS v4.0 Base Metrics — Score 6.2 (MEDIUM)
Attack VectorNetwork
Attack ComplexityLow
Attack RequirementsNone
Privileges RequiredLow
User InteractionActive
Confidentiality (Vulnerable System)None
Integrity (Vulnerable System)None
Availability (Vulnerable System)None
Confidentiality (Subsequent System)High
Integrity (Subsequent System)High
Availability (Subsequent System)None
Affected & Patched Versions
- MISP MISP < 2.5.48
- MISP MISP 2.5.48