{"schema":"threatline.record/2","record":{"id":"CVE-2026-104906","aliases":[],"summary":"MISP TAXII Object Viewer Stored XSS via Unescaped JSON Output","details":"MISP contains a cross-site scripting (XSS) vulnerability in the TAXII object viewer. When displaying a remote TAXII object, the JSON content of string properties was rendered directly into an HTML pre block without HTML-encoding. An attacker who can control or influence the content of a TAXII object (e.g., by publishing a malicious object to a TAXII server that the victim's MISP instance subscribes to) can inject arbitrary HTML or JavaScript that executes in the context of the victim's MISP session.\n\nPreconditions:\n\n- The victim must be an authenticated MISP user with access to the TAXII object viewer.\n\n- The victim must open or view the crafted TAXII object.\n\nImpact:\n\n- Execution of arbitrary JavaScript in the victim's browser within the MISP application context.\n\n- Potential theft of session tokens, API keys, or other sensitive data accessible from the MISP interface.\n\n- Potential for performing actions on behalf of the authenticated user.\n\nAffected versions: <2.5.48.","categories":["Unclassified"],"product":"MISP","vendor":"MISP","ecosystem":null,"affected_ranges":[{"source":"CVE List","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-104906","source_modified_at":"2026-10-02T16:17:21.730Z","fetched_at":"2026-10-23T18:52:38.922436Z","product":"MISP","vendor":"MISP","versions":[{"lessThan":"2.5.48","status":"affected","version":"0","versionType":"semver"}],"defaultStatus":null}],"fixed_versions":[{"source":"CVE List","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-104906","source_modified_at":"2026-10-02T16:17:21.730Z","fetched_at":"2026-10-23T18:52:38.922436Z","package":{"name":"MISP","ecosystem":null},"version":"2.5.48","basis":"first unaffected version stated in the CVE record"}],"cvss":6.2,"severity":"Medium","kev":{"listed":false},"epss":{"probability":0.0036,"percentile":0.28567,"score_date":"2026-10-23"},"published_at":"2026-10-02T15:49:32.948Z","modified_at":"2026-10-02T16:17:21.730Z","provenance":[{"source":"CVE List","url":"https://www.cve.org/CVERecord?id=CVE-2026-104906","fetched_at":"2026-10-23T18:52:38.922436Z","source_modified_at":"2026-10-02T16:17:21.730Z"},{"source":"EPSS","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-104906","fetched_at":"2026-10-23T18:42:43.628194Z","source_modified_at":"2026-10-23"}],"sources":["CVE List","EPSS"],"references":[{"source":"CVE List","url":"https://github.com/MISP/MISP/commit/1bed4ca0c","tags":["patch"]}],"locations":[],"motoko_assessment":{"status":"requires_architecture_review","automatic_remediation":false},"cve_state":"PUBLISHED","cvss_source":"CVE List","ssvc":{"exploitation":"none","automatable":"no","technical_impact":"partial","assessed_at":"2026-10-02T16:17:09.468515Z"},"classification":{"method":"product-first software-layer rules","rules_version":"2.1","matched_on":null,"confidence":"unknown","reviewed":false},"change_timestamp":"2026-10-02T16:17:21.730Z","content_hash":"5c2a681d9bad1e4aeb8f2d232704209adfd53c28deb238f64ed9138790deeeef"}}