CVE-2026-104907

Name of the Vulnerable Software and Affected Versions MISP versions prior to 2.5.48

Description A cross-site scripting (XSS) issue exists in the remote event preview page. When a linked remote server is configured, the event preview renders tag identifiers within an inline JavaScript onclick attribute. While the tag ID value is HTML-escaped, it is not sanitized for the JavaScript string context. This allows a malicious linked server to provide a tag ID containing characters, such as a single quote, that break the JavaScript string literal to inject arbitrary script. This can lead to arbitrary JavaScript execution in the browser session of an authenticated user who interacts with the affected tag element, potentially resulting in session hijacking, data exfiltration, or unauthorized actions.

Recommendations Update to version 2.5.48 or later.