Reflected XSS Vulnerability in MISP Application by MISP

CVE-2026-95661

What is CVE-2026-95661?

MISP is affected by a reflected cross-site scripting (XSS) vulnerability that can be exploited via the attribute histogram view. The vulnerability arises when an attacker manipulates the URL path segment, allowing the $selectedTypes variable to be interpolated directly into a JavaScript array without proper encoding. This flaw enables attackers to execute arbitrary JavaScript in the context of an authenticated user's browser session. Successful exploitation can lead to session hijacking, unauthorized actions on behalf of the user, or the theft of sensitive information from the MISP interface. The attack requires the victim to be logged in and to click on a maliciously crafted URL. To mitigate this threat, ensure that all users update their MISP installations promptly following available security patches.

References