Executive brief
MISP is a threat intelligence platform used by organizations to share and analyze cybersecurity threat information. A reflected cross-site scripting flaw in the attribute histogram feature allows an attacker to execute malicious code in an authenticated user's browser by tricking them into visiting a crafted URL, potentially enabling cookie theft, unauthorized actions, or data exfiltration from the MISP system.
Technical details
The vulnerability exists in the histogram.ctp template where the $selectedTypes variable derived from the URL path is directly interpolated into a JavaScript array literal within an onClick HTML attribute without encoding or escaping. An attacker crafts a malicious URL with a specially-crafted type value and socially engineers an authenticated MISP user to click it, causing arbitrary JavaScript execution in the victim's browser context with access to the MISP origin.
Affected products
- MISP Project MISP
Timeline
- 2026-09-22: disclosed
- 2026-09-22: patched