CVE-2026-85227

What it is

MISP contains a reflected Cross-Site Scripting (XSS) vulnerability in the event attribute filtering query builder. The taggedAttributes and galaxyAttachedAttributes URL parameters were inserted into the query-builder rules without HTML escaping before being serialized as JSON and embedded inside a <script> element. Because JsonTool::encode() uses JSON_UNESCAPED_SLASHES, an attacker-controlled value containing a closing </script> sequence could terminate the surrounding script element and inject arbitrary HTML or JavaScript. For example, a specially crafted viewEventAttributes URL could contain malicious content in one of the affected filter parameters. An attacker could exploit the vulnerability by convincing an authenticated MISP user to follow a crafted URL. Successful exploitation would execute attacker-controlled JavaScript in the security context of the MISP instance and with the privileges of the victim's authenticated browser session. This could allow access to information available to the victim, modification of data through authenticated requests, or other actions permitted by the victim's MISP permissions. The vulnerability is addressed by applying HTML escaping with h() to both scalar and array values before they are inserted into the DOM.

At a glance

Exploitability

Can be exploited over the network without logging in, but needs a user to act. Limited direct impact.

Exploit odds

0.3% chance of exploitation in the next 30 days (EPSS).

Fix

A patch, advisory or fixed version is referenced. Upgrade or apply it.

Timeline

1. 2026-09-03 15:17 UTC PublishedDisclosed publicly on CVE.org and NVD
2. 2026-09-10 19:38 UTC Last updatedMost recent change to the record

Details

Published

2026-09-03 15:17 UTC

Last modified

2026-09-10 19:38 UTC

Exploit probability

0.3% · EPSS, next 30 days

Weakness

CWE-79 · Cross-site scripting

Record status

Analyzed

Affected

• misp-project Misp < 2.5.46

Attack profile CVSS 4.0 · 6.1

Attack vector

Network

Complexity

Low

Attack requirements

None

Privileges needed

None

User interaction

Active

Confidentiality

Low

Integrity

Low

Availability

None