# CVE-2026-8080: MISP Stored XSS in template element attribute handling

Source: https://junglewise.ai/threats/cve-2026-8080-misp-stored-xss-in-template-element-attribute-handling  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-05-07. Updated: 2026-06-22  
License: CC BY 4.0 with a link back

CVE-2026-8080 · Severity: medium · CVSS 5.4 · Published 2026-05-07

MISP, an open-source threat intelligence platform, is vulnerable to a security flaw in its legacy templating engine. An attacker with basic user permissions can inject malicious scripts into template attributes, which could then execute in the browsers of other users. This could lead to unauthorized actions being performed on behalf of legitimate users or the theft of sensitive session information.

Technologies: [Misp](https://junglewise.ai/threats/technologies/misp). Vendors: [Misp](https://junglewise.ai/threats/vendors/misp).

## Quick answers

**Is CVE-2026-8080 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-8080 being exploited in the wild.

**How severe is CVE-2026-8080?** Medium severity, with a CVSS score of 5.4, published 7 May 2026.

**Which products and versions are affected?** MISP Project MISP before 2.5.37.

**Is there a fix for CVE-2026-8080?** A patch was published on 2026-05-07: Fixed in version 2.5.37 Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-8080 attacked?** It is attacked over the network, in a network appliance.

**Am I affected by CVE-2026-8080?** Check whether you run Misp. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

A stored cross-site scripting (XSS) vulnerability exists in MISP versions prior to 2.5.37 within the TemplateElementAttribute handling logic. The application failed to validate the 'type' and 'category' fields against known MISP definitions, allowing arbitrary values to be stored in the database. An authenticated attacker with permissions to create or modify template element attributes can inject malicious JavaScript into these fields. When another user views the affected template, the payload executes in their browser context. This affects the legacy templating engine, which was disabled in 2.5.37 and is scheduled for removal in 2.5.38.

## Affected products

- MISP Project MISP before 2.5.37

## Timeline

- 2026-05-07: disclosed
- 2026-05-07: advisory
- 2026-05-07: patched: Fixed in version 2.5.37

## References

- [https://github.com/MISP/MISP/commit/62824e5ca0056d01b195f70466ea0d382cca06d0](https://github.com/MISP/MISP/commit/62824e5ca0056d01b195f70466ea0d382cca06d0)

## Related threats

- [MISP CSS injection in remote event preview](https://junglewise.ai/threats/cve-2026-112183-misp-contains-a-css-injection-vulnerability-in-the-remote-event)
- [MISP access control flaw in proposal visibility logic](https://junglewise.ai/threats/cve-2026-112178-misp-contains-an-access-control-flaw-in-the-proposal-shadow)
- [MISP authorization flaw in correlation handling](https://junglewise.ai/threats/cve-2026-104912-misp-contains-an-authorization-flaw-in-its-correlation-handling)
- [MISP improper input validation in decaying model import](https://junglewise.ai/threats/cve-2026-104908-misp-contains-an-improper-input-validation-vulnerability-in-the)
- [MISP reflected XSS in taxonomy tag confirmation forms](https://junglewise.ai/threats/cve-2026-103662-misp-contains-a-reflected-cross-site-scripting-xss-vulnerability)