What’s Vulnerable › Vulnerabilities
CVE-2026-94277: Stored Cross-Site Scripting in MISP Galaxy Matrix Statistics via Unescaped Galaxy Name
- Severity: medium (CVSS 6.3 v4.0)
- Exploited in the wild: not listed in CISA KEV
- EPSS: 0.4% probability of exploitation in the next 30 days
- Public exploit or detection template: none known
- Published: 2026-09-21 · updated 2026-09-21
- Weakness: CWE-79
Description
MISP's galaxy matrix statistics view (app/View/Users/statistics_galaxymatrix.ctp) renders the galaxy name directly into HTML output via sprintf() without any HTML encoding. An authenticated user holding the perm_galaxy_editor permission can create or modify a galaxy whose name contains arbitrary HTML or JavaScript markup. Because the value is interpolated verbatim into the page, any user who subsequently opens the galaxy matrix statistics page will have the embedded script executed in their browser context. This enables session hijacking, credential theft, data exfiltration, or the performance of arbitrary actions on behalf of the victim within the MISP application. Version affected: <2.5.47
Affected products
- MISP: before 2.5.47 — fixed in 2.5.47
How to fix
Upgrade to a fixed version: MISP 2.5.47. Check the vendor advisory for mitigations.
References
Get alerted when CVE-2026-94277 or the next vulnerability affects your stack