Persistent Unsafe URL Injection in MISP Dashboard Widget Configuration

CVE-2026-85230

What is CVE-2026-85230?

A vulnerability exists in the MISP dashboard that allows for persistent unsafe URL injections through the ButtonWidget configuration. The issue arises because URLs were only validated at the time of rendering, not during configuration saving. This means that an authenticated user with the ability to modify dashboard settings can insert arbitrary URLs, including those that utilize the javascript: scheme, which can lead to potential client-side script execution within the MISP security context. If such a malicious URL is executed, it could enable an attacker to act with the privileges of the logged-in user or access information tied to their MISP session. To mitigate this risk, the latest patch establishes a canonical URL schema and enforces strict validation of the URLs during configuration saving. This enhancement prevents the acceptance of invalid values such as javascript:, external origins, and malformed URLs, enhancing the overall security of the MISP dashboard.

References