CVE-2026-104906

Name of the Vulnerable Software and Affected Versions MISP versions prior to 2.5.48

Description A cross-site scripting (XSS) issue exists in the TAXII object viewer. The application renders the JSON content of string properties directly into an HTML pre block without proper HTML-encoding when displaying a remote TAXII object. An attacker capable of influencing the content of a TAXII object, such as by publishing a malicious object to a TAXII server that the victim's instance subscribes to, can inject arbitrary HTML or JavaScript. This script executes within the context of the authenticated user's session, potentially leading to the theft of session tokens, API keys, or other sensitive data, and allowing actions to be performed on behalf of the user.

Recommendations Update to version 2.5.48 or later.