Executive brief
MISP is a threat intelligence sharing platform used by organizations to collaborate on security incidents and attack patterns. An authenticated user with editor permissions can inject malicious JavaScript into a galaxy's name, which then executes in the browsers of any user viewing the galaxy statistics page, potentially allowing session hijacking or credential theft.
Technical details
The vulnerability is a stored cross-site scripting (XSS) flaw in the galaxy matrix statistics view where the galaxy name is rendered directly into HTML via sprintf() without HTML encoding. An authenticated attacker with perm_galaxy_editor permission can craft a galaxy name containing JavaScript payload, which executes in the context of any subsequent viewer. The fix involves escaping the galaxy name output to prevent HTML interpretation.
Affected products
- MISP Project MISP before 2.5.47
Timeline
- 2026-09-21: disclosed
- 2026-09-21: patched: Fix committed to repository escaping galaxy name in output