Reflected Cross-Site Scripting in MISP Query Builder
CVE-2026-85227

6.1MEDIUM

Key Information:

Vendor

Misp

Status
Misp
Vendor
CVE Published:
3 September 2026

What is CVE-2026-85227?

MISP contains a reflected Cross-Site Scripting (XSS) vulnerability due to improper handling of user-provided parameters in the event attribute filtering query builder. The vulnerability is exploited when user-supplied values in taggedAttributes and galaxyAttachedAttributes are improperly serialized, allowing an attacker to terminate the element and inject arbitrary JavaScript. This can lead to malicious code execution in the context of an authenticated user's session, resulting in unauthorized access to sensitive information or the ability to modify data. Applying adequate HTML escaping before embedding these parameters in the DOM mitigates this risk.

Affected Version(s)

misp 0 <= 2.5.45

References

https://github.com/MISP/MISP/commit/de51a16db
patch

CVSS V4

Score:
6.1
Severity:
MEDIUM
Confidentiality:
Low
Integrity:
Low
Availability:
None
Attack Vector:
Network
Attack Complexity:
Low
Attack Required:
None
Privileges Required:
Undefined
User Interaction:
Unknown

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

Andras Iklody
elhoim
.