Executive brief
MISP is an open-source threat intelligence platform used by security teams to share malware and attack indicators. A DOM-based cross-site scripting vulnerability in the contextual menu feature allows an attacker to inject malicious scripts that execute in the browser, potentially enabling session hijacking, data theft, or unauthorized actions on behalf of authenticated users.
Technical details
The ContextualMenu JavaScript class assigns user-controllable values directly to the innerHTML property of HTML option elements, which parses and renders HTML markup. An attacker who can influence data rendered in the contextual menu can inject arbitrary HTML or JavaScript that executes within the MISP application origin with the user's privileges. A fix was committed (b062698) that replaces innerHTML assignment with safer alternatives like textContent.
Affected products
- MISP MISP before 2.5.47
Timeline
- 2026-09-21: disclosed
- 2026-09-21: patched: Fix committed in commit b062698f2