Executive brief
MISP is an open-source threat intelligence platform used by organizations to share and analyze security incidents. A reflected cross-site scripting (XSS) vulnerability in the AnalystData feature allows an attacker to inject malicious JavaScript code. An authenticated attacker can trick a victim into clicking a crafted link, potentially stealing session data or performing unauthorized actions within the MISP application.
Technical details
The AnalystDataController::viewForObject action accepts an unvalidated parent object type parameter from the URL and passes it to the Overmind theme's AnalystData thread view element, where it is interpolated into translated strings and rendered without output encoding. The vulnerability is a reflected XSS requiring authentication and user interaction (victim must click the crafted URL). An attacker can execute arbitrary JavaScript in the victim's browser with access to their session context; the fix validates the object type against AnalystData::valid_targets and escapes output at both sinks.
Affected products
- MISP MISP before 2.5.47
Timeline
- 2026-09-22: disclosed