CVE-2026-103321 PUBLISHED

MISP Stored Cross-Site Scripting (XSS) via Unvalidated Event Graph Preview Image

Assigner: CIRCL
Reserved: 30.09.2026 Published: 30.09.2026 Updated: 30.09.2026

MISP contains a stored cross-site script (XSS) vulnerability in the event graph preview feature.

The event graph preview image field was accepted and stored without server-side validation. On the client side, the stored value was rendered into an HTML img element's src attribute via string concatenation, allowing a crafted value to break out of the attribute context and inject arbitrary script.

Preconditions:

  • An authenticated MISP user with the ability to create or modify an event graph entry.

  • A second user (the victim) who views the event graph and triggers the preview popover.

Impact:

  • Execution of arbitrary JavaScript in the victim's browser within the MISP application context.

  • Potential theft of session tokens, cookies, or sensitive data accessible to the victim's browser.

  • Potential for performing actions on behalf of the victim within the MISP application.

Affected: MISP versions prior to the fix (commit applied after v2.5.48).

Metrics

CVSS Vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:P/VC:N/VI:H/VA:N/SC:H/SI:H/SA:N
CVSS Score: 8.3

Product Status

Vendor MISP
Product MISP
Versions
  • affected from 0 to 2.5.48 (excl.)

Solutions

The vulnerability is remediated by enforcing strict server-side validation of the preview image field, restricting it to a well-formed base64-encoded PNG data URL, and by replacing the client-side string-concatenation rendering with DOM-based attribute assignment that does not interpret the value as HTML.

Credits

  • Bastien Bossiroy of NCIA reporter
  • iglocska remediation developer
  • Claude Opus 4.8 remediation developer

References

Problem Types

  • CWE-79 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') CWE
  • CWE-20 Improper Input Validation CWE

Impacts

  • CAPEC-1 Cross Site Scripting (XSS)