Executive brief
MISP, an open-source threat intelligence platform, contains a security flaw in its experimental 'UiBeta' interface. An attacker could use a specially crafted link to run malicious code in the web browser of a logged-in user. This could allow the attacker to perform actions on behalf of the user or access sensitive threat data within the platform.
Technical details
A reflected cross-site scripting (XSS) vulnerability exists in the UiBeta event index view of MISP. The 'urlparams' value is inserted into an inline JavaScript handler using only HTML escaping within a single-quoted string. Because browsers HTML-decode attribute values before parsing JavaScript, a crafted 'searcheventinfo' parameter can include encoded quotes that break out of the string literal. This allows an attacker to execute arbitrary JavaScript in the context of the victim's session. The vulnerability is addressed by properly encoding values as JavaScript string literals using json_encode() before applying HTML escaping.
Affected products
- MISP Project MISP UiBeta component prior to commit b865deb
Timeline
- 2026-06-12: disclosed
- 2026-06-12: advisory