CVE-2026-94372 (GCVE-0-2026-94372)
Vulnerability from cvelistv5
Published
2026-09-21 12:02
Modified
2026-09-21 15:23
Severity ?
VLAI Severity ?
EPSS score ?
CWE
- CWE-79 - Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
Summary
MISP contains a stored cross-site scripting (XSS) vulnerability in the default theme's Galaxies index page. When a MISP instance detects unknown custom or default galaxy clusters during synchronization, it renders sample tag names in an informational notice directed at site administrators. In the default theme, these sample tag names were inserted into the HTML output without HTML-entity encoding. A user with tag-editor privileges could craft a malicious misp-galaxy tag containing arbitrary script. When a site administrator subsequently viewed the Galaxies index page, the crafted tag content was interpreted as executable markup in the administrator's browser session, enabling the attacker to read session data, perform actions on behalf of the administrator, or otherwise compromise the administrator's browser context. The Overmind theme already applied HTML escaping to the same values and was not affected. The vulnerability requires the attacker to possess tag-editor-level access to create the crafted tag and requires the victim (a site administrator) to view the Galaxies index page in the default theme. The impact is limited to the administrator's browser session and does not directly compromise the MISP server process.
Version affected: <2.5.47
References
| URL | Tags | |
|---|---|---|
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-94372",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-09-21T15:22:49.873477Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-09-21T15:23:04.003Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"modules": [
"Galaxies index (default theme)"
],
"product": "MISP",
"programFiles": [
"app/View/Galaxies/index.ctp"
],
"repo": "https://github.com/MISP/MISP",
"vendor": "MISP",
"versions": [
{
"lessThan": "2.5.47",
"status": "affected",
"version": "0",
"versionType": "semver"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "reporter",
"value": "Jeroen Pinoy"
},
{
"lang": "en",
"type": "remediation developer",
"value": "iglocska"
},
{
"lang": "en",
"type": "remediation developer",
"value": "Claude Opus 4.8"
}
],
"descriptions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "\u003cp\u003eMISP contains a stored cross-site scripting (XSS) vulnerability in the default theme\u0027s Galaxies index page. When a MISP instance detects unknown custom or default galaxy clusters during synchronization, it renders sample tag names in an informational notice directed at site administrators. In the default theme, these sample tag names were inserted into the HTML output without HTML-entity encoding. A user with tag-editor privileges could craft a malicious misp-galaxy tag containing arbitrary script. When a site administrator subsequently viewed the Galaxies index page, the crafted tag content was interpreted as executable markup in the administrator\u0027s browser session, enabling the attacker to read session data, perform actions on behalf of the administrator, or otherwise compromise the administrator\u0027s browser context. The Overmind theme already applied HTML escaping to the same values and was not affected. The vulnerability requires the attacker to possess tag-editor-level access to create the crafted tag and requires the victim (a site administrator) to view the Galaxies index page in the default theme. The impact is limited to the administrator\u0027s browser session and does not directly compromise the MISP server process.\u003c/p\u003e\u003cp\u003eVersion affected: \u0026lt;2.5.47\u003c/p\u003e"
}
],
"value": "MISP contains a stored cross-site scripting (XSS) vulnerability in the default theme\u0027s Galaxies index page. When a MISP instance detects unknown custom or default galaxy clusters during synchronization, it renders sample tag names in an informational notice directed at site administrators. In the default theme, these sample tag names were inserted into the HTML output without HTML-entity encoding. A user with tag-editor privileges could craft a malicious misp-galaxy tag containing arbitrary script. When a site administrator subsequently viewed the Galaxies index page, the crafted tag content was interpreted as executable markup in the administrator\u0027s browser session, enabling the attacker to read session data, perform actions on behalf of the administrator, or otherwise compromise the administrator\u0027s browser context. The Overmind theme already applied HTML escaping to the same values and was not affected. The vulnerability requires the attacker to possess tag-editor-level access to create the crafted tag and requires the victim (a site administrator) to view the Galaxies index page in the default theme. The impact is limited to the administrator\u0027s browser session and does not directly compromise the MISP server process.\n\nVersion affected: \u003c2.5.47"
}
],
"impacts": [
{
"capecId": "CAPEC-1",
"descriptions": [
{
"lang": "en",
"value": "CAPEC-1 Improper Neutralization of Input"
}
]
}
],
"metrics": [
{
"cvssV4_0": {
"Automatable": "NOT_DEFINED",
"Recovery": "NOT_DEFINED",
"Safety": "NOT_DEFINED",
"attackComplexity": "LOW",
"attackRequirements": "NONE",
"attackVector": "NETWORK",
"baseScore": 6.3,
"baseSeverity": "MEDIUM",
"privilegesRequired": "LOW",
"providerUrgency": "NOT_DEFINED",
"subAvailabilityImpact": "NONE",
"subConfidentialityImpact": "HIGH",
"subIntegrityImpact": "HIGH",
"userInteraction": "PASSIVE",
"valueDensity": "NOT_DEFINED",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:P/VC:N/VI:N/VA:N/SC:H/SI:H/SA:N",
"version": "4.0",
"vulnAvailabilityImpact": "NONE",
"vulnConfidentialityImpact": "NONE",
"vulnIntegrityImpact": "NONE",
"vulnerabilityResponseEffort": "NOT_DEFINED"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-79",
"description": "CWE-79 Improper Neutralization of Input During Web Page Generation (\u0027Cross-site Scripting\u0027)",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-09-21T12:02:17.104Z",
"orgId": "5a6e4751-2f3f-4070-9419-94fb35b644e8",
"shortName": "CIRCL"
},
"references": [
{
"name": "Security patch",
"tags": [
"patch"
],
"url": "https://github.com/MISP/MISP/commit/ce10436ae"
}
],
"solutions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "\u003cp\u003eThe fix applies CakePHP\u0027s h() HTML-encoding function to each sample tag name before it is interpolated into the HTML notice. This ensures that any angle brackets, quotes, or ampersands contained in user-supplied tag names are rendered as inert HTML entities, preventing script execution in the administrator\u0027s browser.\u003c/p\u003e"
}
],
"value": "The fix applies CakePHP\u0027s h() HTML-encoding function to each sample tag name before it is interpolated into the HTML notice. This ensures that any angle brackets, quotes, or ampersands contained in user-supplied tag names are rendered as inert HTML entities, preventing script execution in the administrator\u0027s browser."
}
],
"title": "Stored Cross-Site Scripting via Unescaped Galaxy Cluster Tag Names in MISP Default Theme Galaxies Index",
"x_gcve": [
{
"extensions": {
"bcp-05-x-01": {
"ai_annotations": [
{
"ai_level": "generated",
"description": "Draft vulnerability metadata was generated from a git-format patch using an Ollama-hosted language model. Human validation is required before publication.",
"gna_source": 1,
"models": [
{
"gna_source": 1,
"identifier": "qwen3.8:27b",
"name": "qwen3.8:27b",
"source": "ollama"
}
],
"review_status": "review",
"scope": "record",
"tags": [
"ai-computer-assisted:llm-generated",
"ai-computer-assisted:classification"
]
}
]
},
"bcp-05-x-02": {
"x_patch2vuln": {
"assumptions": [
"The tag_version_boundary (v2.5.47, 45 commits after fix) is interpreted as the fix landing after v2.5.47; exact affected version range is not explicitly stated in the patch and is marked as less_than 2.5.47 with status affected, but this is an inference.",
"The \u0027tag editor\u0027 role is assumed to be a lower-privilege role than site admin in MISP\u0027s RBAC model, justifying PR:L.",
"UI:P (Passive) is used because the victim only needs to load the Galaxies index page; no click or explicit interaction with the malicious content is required. The previous UI:R value was invalid in CVSS v4.0 (valid values: N, P, A).",
"CAPEC-1 is the closest available pattern; no CAPEC specifically names stored XSS, so the mapping is approximate.",
"The Overmind theme is stated in the commit message as already escaping these values; it is assumed unaffected but no patch evidence for it is provided.",
"The Co-Authored-By line for Claude Opus 4.8 is treated as a remediation developer credit per the supplied metadata; it is unclear whether this represents an AI-assisted contribution or a human developer using AI tooling."
],
"capecRationale": [
{
"capecId": "CAPEC-1",
"rationale": "CAPEC-1 is the closest available pattern describing an attacker supplying malicious input that is not properly neutralized before being used in a context where it is interpreted (here, HTML). No dedicated CAPEC for stored XSS exists in the catalog; CAPEC-1 is the narrowest defensible match for an output-encoding failure. Uncertainty: the pattern is broad and does not specifically name XSS, but it is the best available mapping for an input-escaping deficiency."
}
],
"commit": "ce10436ae989a4580a35ada1557ff9d9107f43ed",
"confidence": "medium",
"credits": [
{
"lang": "en",
"type": "reporter",
"value": "Jeroen Pinoy"
},
{
"lang": "en",
"type": "remediation developer",
"value": "iglocska"
},
{
"lang": "en",
"type": "remediation developer",
"value": "Claude Opus 4.8"
}
],
"cvssRationale": "AV:N: exploited over the network via the web UI. AC:L: the attacker simply creates a tag with a script payload; no race or complex condition. AT:N: no attack-target manipulation required. PR:L: the attacker needs tag-editor privileges (lower than admin) to create the crafted misp-galaxy tag. UI:P: the victim (site admin) must passively view the Galaxies index page for the script to execute. VC/VI/VA:N: the MISP application process itself is not directly compromised; the impact is on the victim\u0027s browser session. SC:H: the attacker can read the admin\u0027s session cookies, tokens, and data visible in the browser. SI:H: the attacker can perform authenticated actions as the admin via the compromised session. SA:N: no meaningful availability impact on the scope component.",
"draft": false,
"fixSummary": "The fix applies CakePHP\u0027s h() HTML-encoding function to each sample tag name before it is interpolated into the HTML notice. This ensures that any angle brackets, quotes, or ampersands contained in user-supplied tag names are rendered as inert HTML entities, preventing script execution in the administrator\u0027s browser.",
"generatedAt": "2026-09-21T11:56:43.983892Z",
"generator": "patch2vuln.py",
"model": "qwen3.8:27b",
"modelComparison": {
"rankings": [
{
"agreementScore": 9,
"assumptionCount": 6,
"confidence": "medium",
"model": "qwen3.8:27b",
"score": 4
}
],
"selectedModel": "qwen3.8:27b",
"selectionMethod": "deterministic-consensus-v1",
"selectionNotice": "The selected result is closest to model consensus; this heuristic does not establish factual correctness and human review remains required."
},
"patchSha256": "c629d71fb493dcf9ae82dd54bd424cd4335e7638f3db46ec4c0ae90695abb535",
"patchSummary": "In app/View/Galaxies/index.ctp, two lines that built $tagSampleHTML via sprintf and implode over the unknownCustomClustersSamples and unknownDefaultClustersSamples arrays were modified to wrap each array with array_map(\u0027h\u0027, ...) before the implode. This causes every element to pass through CakePHP\u0027s h() helper (HTML entity encoding) prior to concatenation into the \u003cli\u003e list markup. No other logic, routing, or authorization changes were made.",
"patchTruncated": false,
"patches": [
{
"commit": "ce10436ae989a4580a35ada1557ff9d9107f43ed",
"patchSha256": "c629d71fb493dcf9ae82dd54bd424cd4335e7638f3db46ec4c0ae90695abb535",
"source": "https://github.com/MISP/MISP/commit/ce10436ae.patch",
"sourceUrl": "https://github.com/MISP/MISP/commit/ce10436ae.patch",
"subject": "fix: [security] Escape unknown-cluster samples in the"
}
],
"source": "https://github.com/MISP/MISP/commit/ce10436ae.patch",
"subject": "fix: [security] Escape unknown-cluster samples in the",
"tagVersionBoundary": {
"commits_after_fix": 45,
"repository": "https://github.com/MISP/MISP",
"tag": "v2.5.47",
"version": "2.5.47",
"version_type": "semver"
},
"weaknessRationale": [
{
"cweId": "CWE-79",
"rationale": "User-controlled tag names (misp-galaxy tags created by a tag editor) are inserted into an HTML page without output encoding, allowing script injection. This is a classic stored XSS (CWE-79) where the dangerous data is persisted in the database and rendered unsafely in a server-side template."
}
]
}
}
},
"recordType": "advisory",
"vulnId": "GCVE-1-2026-20002"
}
]
}
},
"cveMetadata": {
"assignerOrgId": "5a6e4751-2f3f-4070-9419-94fb35b644e8",
"assignerShortName": "CIRCL",
"cveId": "CVE-2026-94372",
"datePublished": "2026-09-21T12:02:17.104Z",
"dateReserved": "2026-09-21T12:02:13.614Z",
"dateUpdated": "2026-09-21T15:23:04.003Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2",
"vulnerability-lookup:meta": {
"vulnrichment": {
"containers": "{\"adp\": [{\"title\": \"CISA ADP Vulnrichment\", \"metrics\": [{\"other\": {\"type\": \"ssvc\", \"content\": {\"id\": \"CVE-2026-94372\", \"role\": \"CISA Coordinator\", \"options\": [{\"Exploitation\": \"none\"}, {\"Automatable\": \"no\"}, {\"Technical Impact\": \"partial\"}], \"version\": \"2.0.3\", \"timestamp\": \"2026-09-21T15:22:49.873477Z\"}}}], \"providerMetadata\": {\"orgId\": \"134c704f-9b21-4f2e-91b3-4a467353bcc0\", \"shortName\": \"CISA-ADP\", \"dateUpdated\": \"2026-09-21T15:22:56.944Z\"}}], \"cna\": {\"title\": \"Stored Cross-Site Scripting via Unescaped Galaxy Cluster Tag Names in MISP Default Theme Galaxies Index\", \"x_gcve\": [{\"vulnId\": \"GCVE-1-2026-20002\", \"extensions\": {\"bcp-05-x-01\": {\"ai_annotations\": [{\"tags\": [\"ai-computer-assisted:llm-generated\", \"ai-computer-assisted:classification\"], \"scope\": \"record\", \"models\": [{\"name\": \"qwen3.8:27b\", \"source\": \"ollama\", \"gna_source\": 1, \"identifier\": \"qwen3.8:27b\"}], \"ai_level\": \"generated\", \"gna_source\": 1, \"description\": \"Draft vulnerability metadata was generated from a git-format patch using an Ollama-hosted language model. Human validation is required before publication.\", \"review_status\": \"review\"}]}, \"bcp-05-x-02\": {\"x_patch2vuln\": {\"draft\": false, \"model\": \"qwen3.8:27b\", \"commit\": \"ce10436ae989a4580a35ada1557ff9d9107f43ed\", \"source\": \"https://github.com/MISP/MISP/commit/ce10436ae.patch\", \"credits\": [{\"lang\": \"en\", \"type\": \"reporter\", \"value\": \"Jeroen Pinoy\"}, {\"lang\": \"en\", \"type\": \"remediation developer\", \"value\": \"iglocska\"}, {\"lang\": \"en\", \"type\": \"remediation developer\", \"value\": \"Claude Opus 4.8\"}], \"patches\": [{\"commit\": \"ce10436ae989a4580a35ada1557ff9d9107f43ed\", \"source\": \"https://github.com/MISP/MISP/commit/ce10436ae.patch\", \"subject\": \"fix: [security] Escape unknown-cluster samples in the\", \"sourceUrl\": \"https://github.com/MISP/MISP/commit/ce10436ae.patch\", \"patchSha256\": \"c629d71fb493dcf9ae82dd54bd424cd4335e7638f3db46ec4c0ae90695abb535\"}], \"subject\": \"fix: [security] Escape unknown-cluster samples in the\", \"generator\": \"patch2vuln.py\", \"confidence\": \"medium\", \"fixSummary\": \"The fix applies CakePHP\u0027s h() HTML-encoding function to each sample tag name before it is interpolated into the HTML notice. This ensures that any angle brackets, quotes, or ampersands contained in user-supplied tag names are rendered as inert HTML entities, preventing script execution in the administrator\u0027s browser.\", \"assumptions\": [\"The tag_version_boundary (v2.5.47, 45 commits after fix) is interpreted as the fix landing after v2.5.47; exact affected version range is not explicitly stated in the patch and is marked as less_than 2.5.47 with status affected, but this is an inference.\", \"The \u0027tag editor\u0027 role is assumed to be a lower-privilege role than site admin in MISP\u0027s RBAC model, justifying PR:L.\", \"UI:P (Passive) is used because the victim only needs to load the Galaxies index page; no click or explicit interaction with the malicious content is required. The previous UI:R value was invalid in CVSS v4.0 (valid values: N, P, A).\", \"CAPEC-1 is the closest available pattern; no CAPEC specifically names stored XSS, so the mapping is approximate.\", \"The Overmind theme is stated in the commit message as already escaping these values; it is assumed unaffected but no patch evidence for it is provided.\", \"The Co-Authored-By line for Claude Opus 4.8 is treated as a remediation developer credit per the supplied metadata; it is unclear whether this represents an AI-assisted contribution or a human developer using AI tooling.\"], \"generatedAt\": \"2026-09-21T11:56:43.983892Z\", \"patchSha256\": \"c629d71fb493dcf9ae82dd54bd424cd4335e7638f3db46ec4c0ae90695abb535\", \"patchSummary\": \"In app/View/Galaxies/index.ctp, two lines that built $tagSampleHTML via sprintf and implode over the unknownCustomClustersSamples and unknownDefaultClustersSamples arrays were modified to wrap each array with array_map(\u0027h\u0027, ...) before the implode. This causes every element to pass through CakePHP\u0027s h() helper (HTML entity encoding) prior to concatenation into the \u003cli\u003e list markup. No other logic, routing, or authorization changes were made.\", \"cvssRationale\": \"AV:N: exploited over the network via the web UI. AC:L: the attacker simply creates a tag with a script payload; no race or complex condition. AT:N: no attack-target manipulation required. PR:L: the attacker needs tag-editor privileges (lower than admin) to create the crafted misp-galaxy tag. UI:P: the victim (site admin) must passively view the Galaxies index page for the script to execute. VC/VI/VA:N: the MISP application process itself is not directly compromised; the impact is on the victim\u0027s browser session. SC:H: the attacker can read the admin\u0027s session cookies, tokens, and data visible in the browser. SI:H: the attacker can perform authenticated actions as the admin via the compromised session. SA:N: no meaningful availability impact on the scope component.\", \"capecRationale\": [{\"capecId\": \"CAPEC-1\", \"rationale\": \"CAPEC-1 is the closest available pattern describing an attacker supplying malicious input that is not properly neutralized before being used in a context where it is interpreted (here, HTML). No dedicated CAPEC for stored XSS exists in the catalog; CAPEC-1 is the narrowest defensible match for an output-encoding failure. Uncertainty: the pattern is broad and does not specifically name XSS, but it is the best available mapping for an input-escaping deficiency.\"}], \"patchTruncated\": false, \"modelComparison\": {\"rankings\": [{\"model\": \"qwen3.8:27b\", \"score\": 4, \"confidence\": \"medium\", \"agreementScore\": 9, \"assumptionCount\": 6}], \"selectedModel\": \"qwen3.8:27b\", \"selectionMethod\": \"deterministic-consensus-v1\", \"selectionNotice\": \"The selected result is closest to model consensus; this heuristic does not establish factual correctness and human review remains required.\"}, \"weaknessRationale\": [{\"cweId\": \"CWE-79\", \"rationale\": \"User-controlled tag names (misp-galaxy tags created by a tag editor) are inserted into an HTML page without output encoding, allowing script injection. This is a classic stored XSS (CWE-79) where the dangerous data is persisted in the database and rendered unsafely in a server-side template.\"}], \"tagVersionBoundary\": {\"tag\": \"v2.5.47\", \"version\": \"2.5.47\", \"repository\": \"https://github.com/MISP/MISP\", \"version_type\": \"semver\", \"commits_after_fix\": 45}}}}, \"recordType\": \"advisory\"}], \"credits\": [{\"lang\": \"en\", \"type\": \"reporter\", \"value\": \"Jeroen Pinoy\"}, {\"lang\": \"en\", \"type\": \"remediation developer\", \"value\": \"iglocska\"}, {\"lang\": \"en\", \"type\": \"remediation developer\", \"value\": \"Claude Opus 4.8\"}], \"impacts\": [{\"capecId\": \"CAPEC-1\", \"descriptions\": [{\"lang\": \"en\", \"value\": \"CAPEC-1 Improper Neutralization of Input\"}]}], \"metrics\": [{\"format\": \"CVSS\", \"cvssV4_0\": {\"Safety\": \"NOT_DEFINED\", \"version\": \"4.0\", \"Recovery\": \"NOT_DEFINED\", \"baseScore\": 6.3, \"Automatable\": \"NOT_DEFINED\", \"attackVector\": \"NETWORK\", \"baseSeverity\": \"MEDIUM\", \"valueDensity\": \"NOT_DEFINED\", \"vectorString\": \"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:P/VC:N/VI:N/VA:N/SC:H/SI:H/SA:N\", \"providerUrgency\": \"NOT_DEFINED\", \"userInteraction\": \"PASSIVE\", \"attackComplexity\": \"LOW\", \"attackRequirements\": \"NONE\", \"privilegesRequired\": \"LOW\", \"subIntegrityImpact\": \"HIGH\", \"vulnIntegrityImpact\": \"NONE\", \"subAvailabilityImpact\": \"NONE\", \"vulnAvailabilityImpact\": \"NONE\", \"subConfidentialityImpact\": \"HIGH\", \"vulnConfidentialityImpact\": \"NONE\", \"vulnerabilityResponseEffort\": \"NOT_DEFINED\"}, \"scenarios\": [{\"lang\": \"en\", \"value\": \"GENERAL\"}]}], \"affected\": [{\"repo\": \"https://github.com/MISP/MISP\", \"vendor\": \"MISP\", \"modules\": [\"Galaxies index (default theme)\"], \"product\": \"MISP\", \"versions\": [{\"status\": \"affected\", \"version\": \"0\", \"lessThan\": \"2.5.47\", \"versionType\": \"semver\"}], \"programFiles\": [\"app/View/Galaxies/index.ctp\"]}], \"solutions\": [{\"lang\": \"en\", \"value\": \"The fix applies CakePHP\u0027s h() HTML-encoding function to each sample tag name before it is interpolated into the HTML notice. This ensures that any angle brackets, quotes, or ampersands contained in user-supplied tag names are rendered as inert HTML entities, preventing script execution in the administrator\u0027s browser.\", \"supportingMedia\": [{\"type\": \"text/html\", \"value\": \"\u003cp\u003eThe fix applies CakePHP\u0027s h() HTML-encoding function to each sample tag name before it is interpolated into the HTML notice. This ensures that any angle brackets, quotes, or ampersands contained in user-supplied tag names are rendered as inert HTML entities, preventing script execution in the administrator\u0027s browser.\u003c/p\u003e\", \"base64\": false}]}], \"references\": [{\"url\": \"https://github.com/MISP/MISP/commit/ce10436ae\", \"name\": \"Security patch\", \"tags\": [\"patch\"]}], \"descriptions\": [{\"lang\": \"en\", \"value\": \"MISP contains a stored cross-site scripting (XSS) vulnerability in the default theme\u0027s Galaxies index page. When a MISP instance detects unknown custom or default galaxy clusters during synchronization, it renders sample tag names in an informational notice directed at site administrators. In the default theme, these sample tag names were inserted into the HTML output without HTML-entity encoding. A user with tag-editor privileges could craft a malicious misp-galaxy tag containing arbitrary script. When a site administrator subsequently viewed the Galaxies index page, the crafted tag content was interpreted as executable markup in the administrator\u0027s browser session, enabling the attacker to read session data, perform actions on behalf of the administrator, or otherwise compromise the administrator\u0027s browser context. The Overmind theme already applied HTML escaping to the same values and was not affected. The vulnerability requires the attacker to possess tag-editor-level access to create the crafted tag and requires the victim (a site administrator) to view the Galaxies index page in the default theme. The impact is limited to the administrator\u0027s browser session and does not directly compromise the MISP server process.\\n\\nVersion affected: \u003c2.5.47\", \"supportingMedia\": [{\"type\": \"text/html\", \"value\": \"\u003cp\u003eMISP contains a stored cross-site scripting (XSS) vulnerability in the default theme\u0027s Galaxies index page. When a MISP instance detects unknown custom or default galaxy clusters during synchronization, it renders sample tag names in an informational notice directed at site administrators. In the default theme, these sample tag names were inserted into the HTML output without HTML-entity encoding. A user with tag-editor privileges could craft a malicious misp-galaxy tag containing arbitrary script. When a site administrator subsequently viewed the Galaxies index page, the crafted tag content was interpreted as executable markup in the administrator\u0027s browser session, enabling the attacker to read session data, perform actions on behalf of the administrator, or otherwise compromise the administrator\u0027s browser context. The Overmind theme already applied HTML escaping to the same values and was not affected. The vulnerability requires the attacker to possess tag-editor-level access to create the crafted tag and requires the victim (a site administrator) to view the Galaxies index page in the default theme. The impact is limited to the administrator\u0027s browser session and does not directly compromise the MISP server process.\u003c/p\u003e\u003cp\u003eVersion affected: \u0026lt;2.5.47\u003c/p\u003e\", \"base64\": false}]}], \"problemTypes\": [{\"descriptions\": [{\"lang\": \"en\", \"type\": \"CWE\", \"cweId\": \"CWE-79\", \"description\": \"CWE-79 Improper Neutralization of Input During Web Page Generation (\u0027Cross-site Scripting\u0027)\"}]}], \"providerMetadata\": {\"orgId\": \"5a6e4751-2f3f-4070-9419-94fb35b644e8\", \"shortName\": \"CIRCL\", \"dateUpdated\": \"2026-09-21T12:02:17.104Z\"}}}",
"cveMetadata": "{\"cveId\": \"CVE-2026-94372\", \"state\": \"PUBLISHED\", \"dateUpdated\": \"2026-09-21T15:23:04.003Z\", \"dateReserved\": \"2026-09-21T12:02:13.614Z\", \"assignerOrgId\": \"5a6e4751-2f3f-4070-9419-94fb35b644e8\", \"datePublished\": \"2026-09-21T12:02:17.104Z\", \"assignerShortName\": \"CIRCL\"}",
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
}
}
Loading…
Loading…
Sightings
| Author | Source | Type | Date |
|---|
Nomenclature
- Seen: The vulnerability was mentioned, discussed, or seen somewhere by the user.
- Confirmed: The vulnerability is confirmed from an analyst perspective.
- Published Proof of Concept: A public proof of concept is available for this vulnerability.
- Exploited: This vulnerability was exploited and seen by the user reporting the sighting.
- Patched: This vulnerability was successfully patched by the user reporting the sighting.
- Not exploited: This vulnerability was not exploited or seen by the user reporting the sighting.
- Not confirmed: The user expresses doubt about the veracity of the vulnerability.
- Not patched: This vulnerability was not successfully patched by the user reporting the sighting.
Loading…
Loading…