Reflected XSS Vulnerability in MISP Taxonomy Tag Management

CVE-2026-103662

What is CVE-2026-103662?

A reflected cross-site scripting (XSS) vulnerability exists in MISP's legacy taxonomy tag management confirmation forms, specifically during the add tag and disable tag processes. This vulnerability is due to the improper handling of user-supplied tag name values, which are echoed unescaped into the HTML output. An attacker can exploit this by creating a malicious URL containing a specially crafted tag name parameter. Upon navigating to this URL, an authenticated site administrator may unknowingly execute arbitrary JavaScript in their browser session, leading to the possible theft of session tokens or other sensitive information. Furthermore, this could allow attackers to perform sensitive actions within the MISP interface on behalf of the administrator.

References