Reflected Cross-Site Scripting Vulnerability in MISP by MISP

CVE-2026-95665

What is CVE-2026-95665?

MISP is susceptible to a reflected XSS vulnerability in the event REST search export confirmation form. The flaw arises from the rendering of a URL-supplied event ID list into a single-quoted JavaScript string literal via PHP's json_encode() function. Since single quotes are not escaped, attackers can inject arbitrary JavaScript code that executes within the victim's browser session. This requires the victim to be an authenticated MISP user who opens a crafted URL, enabling malicious actors to hijack user sessions or exfiltrate sensitive data without prior access to MISP. While the integrity of MISP's components remains intact, the risk is substantial for user session security.

References