MISP: Stored cross-site scripting in event graph preview
Summary
MISP stores the event graph preview image without server-side validation and inserts it into HTML without proper escaping. An authenticated user who can create or modify an event graph entry can plant a crafted value that runs JavaScript in the browser of any user who opens the preview. The attacker could then steal session tokens or cookies or act on behalf of the victim within MISP.
Affected
- MISP versions before the fix (the CVE record lists 0 to < 2.5.48; the fix is described as applied after v2.5.48)
- Exact first fixed release: Unknown.
Fixed in
- Fix: commit 92c7ccc43 in the MISP repository (server-side validation of the preview image and DOM-based attribute assignment).
- First fixed release: Unknown. Third-party data lists 2.5.48 as fixed, which conflicts with the CVE record.
Workaround
- Unknown. No vendor workaround is documented.
- Restrict who can create or modify event graph entries.
- Review existing event graph entries for unexpected preview image values.
- Limit access to the MISP web interface to trusted staff.
Exploitation
- CISA SSVC: Exploitation none, automatable no, technical impact partial.
- Not marked as known exploited in the sources reviewed.
- Public proof of concept: Unknown.
Our recommendation
- Identify whether you operate a MISP instance and which version it runs.
- Update to the release containing commit 92c7ccc43 as soon as it is confirmed; if 2.5.48 is in use, do not assume it is fixed.
- Apply the interim measures above until the update is done.
- Check whether many users can create events or whether the instance ingests events from partner communities, as this raises the risk.
- Monitor for unexpected changes to event graph entries.
Public exploits
PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.
Research sources
- MISP fix commit 92c7ccc43 github.com
- OSV: CVE-2026-103321 osv.dev
- HOL: CVE-2026-103321 hol.org
- Zigrin advisory: MISP stored XSS in the event graph zigrin.com
- MISP security page misp.software
Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 1 Nov 2026, 14:26.
Original description (NVD)
MISP contains a stored cross-site script (XSS) vulnerability in the event graph preview feature. The event graph preview image field was accepted and stored without server-side validation. On the client side, the stored value was rendered into an HTML img element's src attribute via string concatenation, allowing a crafted value to break out of the attribute context and inject arbitrary script. Preconditions: - An authenticated MISP user with the ability to create or modify an event graph entry. - A second user (the victim) who views the event graph and triggers the preview popover. Impact: - Execution of arbitrary JavaScript in the victim's browser within the MISP application context. - Potential theft of session tokens, cookies, or sensitive data accessible to the victim's browser. - Potential for performing actions on behalf of the victim within the MISP application. Affected: MISP versions prior to the fix (commit applied after v2.5.48).
NVD references (1)
Sources
The tracker combines official, freely usable data sources – updated continuously:
- NVD (NIST) – CVEs, rating (CVSS), affected products
- CISA KEV – vulnerabilities confirmed by CISA as actively exploited
- CISA Vulnrichment – CISA assessment (SSVC) in the official CVE record
- FIRST EPSS – probability of exploitation
- Microsoft MSRC – Patch Tuesday: vulnerabilities, severity, updates
- PoC-in-GitHub – public proof-of-concept repositories
- Metasploit (Rapid7) – modules of the Metasploit Framework
- Exploit-DB (OffSec) – archive of public exploits (links only)
- Patch days: official vendor pages (linked per vendor) (Vendor patch days)
This product uses data from the NVD API but is not endorsed or certified by the NVD. EPSS data © FIRST.org.
Affected? We can help.
We check whether your systems are affected, install updates and close the gap – continuously with the System Health Checker if you wish.