Quick answers
- Is CVE-2026-104907 exploited in the wild?
- No. Junglewise Threat Intelligence has no report of CVE-2026-104907 being exploited in the wild.
- How severe is CVE-2026-104907?
- Informational severity, published 2 October 2026.
- Which products and versions are affected?
- MISP Project MISP prior to v2.5.48.
- Is there a fix for CVE-2026-104907?
- Yes: fixed in MISP v2.5.48 or later. Until then: Disable or restrict connections to untrusted linked MISP servers until the instance can be upgraded. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
- How is CVE-2026-104907 attacked?
- It is attacked over the network, in a web application.
- Am I affected by CVE-2026-104907?
- Check whether you run MISP Project MISP at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.
How to fix
- Fixed in: MISP v2.5.48 or later
Disable or restrict connections to untrusted linked MISP servers until the instance can be upgraded.
Technical details
The vulnerability is a stored/reflected XSS in the remote event preview page where tag identifiers from linked MISP servers are inserted into inline JavaScript onclick attributes. Tag ID values were HTML-escaped but not properly sanitized for the JavaScript string context, allowing a malicious linked server to inject characters (such as quotes) that break out of the string literal and execute arbitrary script. The fix casts the tag ID to an integer, preventing string breakout.
Affected products
- MISP Project MISP prior to v2.5.48
Timeline
- 2026-10-02: disclosed
- 2026-10-02: patched