All vulnerabilities
CVE-2026-104906

MISP TAXII Object Viewer Stored XSS via Unescaped JSON Output

MISP MISP
Open in ThreatlineRecord JSON
CVSS
6.2Medium
ExploitationNo known exploitationNot in CISA KEV, which does not prove it is unexploitedCISA KEV
Exploit odds (EPSS)0.36%Chance of exploitation activity in the next 30 days, higher than 28% of CVEs. Scored 23 Oct 2026FIRST EPSS
Fixed in2.5.48Fixed versionCVE List
Published2 Oct 2026Updated 2 Oct 2026CVE List

What fixes it

A fixed version on one release line is not the upgrade target for every line. Check your exact version and any vendor backports.

Description

MISP contains a cross-site scripting (XSS) vulnerability in the TAXII object viewer. When displaying a remote TAXII object, the JSON content of string properties was rendered directly into an HTML pre block without HTML-encoding. An attacker who can control or influence the content of a TAXII object (e.g., by publishing a malicious object to a TAXII server that the victim's MISP instance subscribes to) can inject arbitrary HTML or JavaScript that executes in the context of the victim's MISP session.

Preconditions:

  • The victim must be an authenticated MISP user with access to the TAXII object viewer.
  • The victim must open or view the crafted TAXII object.

Impact:

  • Execution of arbitrary JavaScript in the victim's browser within the MISP application context.
  • Potential theft of session tokens, API keys, or other sensitive data accessible from the MISP interface.
  • Potential for performing actions on behalf of the authenticated user.

Affected versions: <2.5.48.

Text from CVE List

Affected versions 1

  • MISPaffected: all versions before 2.5.48CVE List

References 1