Executive brief
MISP BSimVis is a visualization tool used for analyzing security threat data. A vulnerability in how the tool displays labels and metadata allows an attacker to inject malicious code into the system. If a user views a page containing this malicious data, the code could execute in their browser, potentially allowing the attacker to steal information or perform unauthorized actions on the user's behalf.
Technical details
A stored cross-site scripting (XSS) vulnerability exists in the tag rendering code of MISP BSimVis through version 0.2.0. The application fails to properly escape tag names, collection names, entity identifiers, and metadata before interpolating them into HTML, attributes, JavaScript event handlers, and CSS values. An attacker can store a crafted payload in these fields that executes arbitrary JavaScript in the context of a victim's browser session. The vulnerability has been addressed in a commit that introduces shared escaping helpers for various output contexts.
Affected products
- MISP bsimvis through v0.2.0
Timeline
- 2026-06-10: disclosed
- 2026-06-10: advisory