CVE-2026-54395

Name of the Vulnerable Software and Affected Versions MISP (affected versions not specified)

Description A reflected cross-site scripting issue exists in the UiBeta event index view. The urlparams value is inserted into an inline JavaScript handler using HTML escaping within a single-quoted JavaScript string. Since browsers HTML-decode attribute values before JavaScript parsing, a specially crafted searcheventinfo value can restore encoded quote characters to break out of the JavaScript string. This allows an attacker to craft a malicious URL that executes arbitrary JavaScript in the victim's browser within the context of the MISP instance.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.