Executive brief
MISP, a widely used open-source threat intelligence platform, contains a security vulnerability in its workflow engine. An attacker with basic user access could inject malicious scripts that execute when other users view the workflow execution path. This could lead to unauthorized actions being performed in the context of the victim's session or the theft of sensitive session information.
Technical details
A stored cross-site scripting (XSS) vulnerability exists in MISP versions prior to 2.5.28. The flaw is located in 'app/View/Elements/Workflows/executionPath.ctp' and stems from improper neutralization of input within the doT.js template engine used by the workflow engine. An authenticated attacker with low privileges can inject malicious JavaScript into workflow elements (such as names or icons). When an administrative user or another analyst views the workflow execution path, the malicious script executes in their browser context. This can be used to exfiltrate data or perform unauthorized administrative actions. The issue was fixed by updating the template syntax to use secure interpolation ('{{ ! }}') instead of unescaped interpolation ('{{ = }}').
Affected products
- MISP Project MISP < 2.5.28
Timeline
- 2025-12-14: disclosed
- 2025-12-14: advisory
- 2025-12-15: patched: Fix committed in version 2.5.28