What’s Vulnerable › Vulnerabilities
CVE-2026-54395: MISP UiBeta event index reflected XSS in advanced filter popup
- Severity: medium (CVSS 5.3 v4.0)
- Exploited in the wild: not listed in CISA KEV
- EPSS: 0.3% probability of exploitation in the next 30 days
- Public exploit or detection template: none known
- Published: 2026-06-12 · updated 2026-06-17
- Weakness: CWE-79
Description
MISP contains a reflected cross-site scripting vulnerability in the UiBeta event index view. The urlparams value is inserted into an inline JavaScript handler using HTML escaping inside a single-quoted JavaScript string. Because browsers HTML-decode attribute values before JavaScript parsing, a crafted searcheventinfo value can restore encoded quote characters and break out of the JavaScript string. An attacker could craft a malicious URL that, when opened by a victim using the UiBeta event index, executes arbitrary JavaScript in the victim’s browser in the context of the MISP instance. The issue is fixed by encoding the value as a JavaScript string literal with json_encode() before applying HTML escaping at the attribute layer.
Affected products
- MISP: before 2.5.40 — fixed in 2.5.40
How to fix
Upgrade to a fixed version: MISP 2.5.40. Check the vendor advisory for mitigations.
References
Get alerted when CVE-2026-54395 or the next vulnerability affects your stack