Stored XSS Vulnerability in MISP's Default Theme Affecting Administrators

CVE-2026-94372

What is CVE-2026-94372?

MISP's default theme features a stored cross-site scripting vulnerability on the Galaxies index page, which can be exploited by users with tag-editor privileges. During synchronization, if unknown galaxy clusters are detected, sample tag names are displayed directly in the HTML output without proper encoding. An attacker can create a malicious misp-galaxy tag that, when viewed by an administrator, executes unauthorized scripts within the browser session. This allows the attacker to read sensitive session data or perform actions as the administrator, posing significant risks to the administrator's context. The Overmind theme has addressed this issue, as it employs HTML escaping for tag names, thus preventing exploitation.

References