CVE-2026-104900

Name of the Vulnerable Software and Affected Versions MISP versions prior to 2.5.48

Description A stored cross-site scripting (XSS) issue exists in the index table rendering of the remote event preview. The count field template fails to apply HTML encoding to the field value, although it escapes the associated link URL. An attacker with permissions to create or modify events on a linked remote MISP server can craft an event identifier containing HTML or JavaScript markup. When a user on the local instance views the remote event preview index, the unescaped value is rendered in the browser, enabling arbitrary script execution. This can lead to session hijacking, data exfiltration, or unauthorized actions performed as the authenticated user.

Recommendations Update to version 2.5.48 or later.