Stored Cross-Site Scripting Vulnerability in MISP by MISP.org

CVE-2026-95682

What is CVE-2026-95682?

A stored cross-site scripting (XSS) vulnerability exists in the admin email composition screen of MISP, arising from inadequate output encoding in a JavaScript context. Specifically, the MISP.org organization name is interpolated directly into a JavaScript string without proper sanitization. This flaw can allow an attacker to inject arbitrary JavaScript code, which may execute in the browser of any authenticated user accessing the affected page. The exploitation of this vulnerability requires the attacker to have permission to modify the organization name and for a second authenticated user to visit the compromised admin email view. Attackers can potentially hijack sessions, exfiltrate data, or perform unauthorized actions on behalf of the victim. Prompt application of security patches is crucial to mitigate this risk.

References