Insufficient URL Validation in MISP Button Widget by MISP

CVE-2026-86440

What is CVE-2026-86440?

MISP's Button widget is susceptible to vulnerabilities due to inadequate URL validation. Specifically, prior URL parsing logic incorrectly classified certain dangerous URL schemes as safe, allowing potentially malicious javascript: URLs and non-standard authority forms to execute in the browser. This could lead to script execution or navigation to an attacker-controlled domain when users interact with the widget. The recent fixes ensure that widget URLs are validated more rigorously to reject harmful schemes, control characters, and unauthorized origins, thus securing users against potential cross-site scripting (XSS) attacks.

References