CSS Injection Vulnerability in MISP Remote Event Preview Feature

CVE-2026-112183

What is CVE-2026-112183?

The MISP platform has a vulnerability in the remote event preview feature that allows CSS injection via unvalidated color values associated with remote tags. When an event is previewed from a linked MISP server, the color information is directly placed into an inline CSS style attribute. Malicious actors can exploit this by creating or modifying tags on a compromised linked server, executing arbitrary CSS commands that can manipulate the user interface or disclose data. Preconditions for this exploitation include an existing relationship between the victim and attacker-controlled MISP instances, with the attacker having the ability to create or modify tags, and a user viewing the affected event preview page.

References