All vulnerabilities
CVE-2026-103321

MISP Stored Cross-Site Scripting (XSS) via Unvalidated Event Graph Preview Image

MISP MISP
Open in ThreatlineRecord JSON
CVSS
8.3High
ExploitationNo known exploitationNot in CISA KEV, which does not prove it is unexploitedCISA KEV
Exploit odds (EPSS)0.36%Chance of exploitation activity in the next 30 days, higher than 28% of CVEs. Scored 23 Oct 2026FIRST EPSS
Fixed in2.5.48Fixed versionCVE List
Published30 Sep 2026Updated 30 Sep 2026CVE List

What fixes it

A fixed version on one release line is not the upgrade target for every line. Check your exact version and any vendor backports.

Description

MISP contains a stored cross-site script (XSS) vulnerability in the event graph preview feature.

The event graph preview image field was accepted and stored without server-side validation. On the client side, the stored value was rendered into an HTML img element's src attribute via string concatenation, allowing a crafted value to break out of the attribute context and inject arbitrary script.

Preconditions:

  • An authenticated MISP user with the ability to create or modify an event graph entry.
  • A second user (the victim) who views the event graph and triggers the preview popover.

Impact:

  • Execution of arbitrary JavaScript in the victim's browser within the MISP application context.
  • Potential theft of session tokens, cookies, or sensitive data accessible to the victim's browser.
  • Potential for performing actions on behalf of the victim within the MISP application.

Affected: MISP versions prior to the fix (commit applied after v2.5.48).

Text from CVE List

Affected versions 1

  • MISPaffected: all versions before 2.5.48CVE List

References 1