CVE-2026-85227

Name of the Vulnerable Software and Affected Versions MISP (affected versions not specified)

Description A reflected Cross-Site Scripting (XSS) issue exists in the event attribute filtering query builder. The taggedAttributes and galaxyAttachedAttributes URL parameters are inserted into query-builder rules without HTML escaping before being serialized as JSON and embedded within a <script> element. Because JsonTool::encode() uses JSON UNESCAPED SLASHES, a value containing a closing </script> sequence can terminate the script element and inject arbitrary HTML or JavaScript. An attacker can exploit this by tricking an authenticated user into following a crafted URL, executing malicious JavaScript within the security context of the MISP instance and the victim's session privileges. This may lead to unauthorized data access or modification based on the victim's permissions.

Recommendations Apply HTML escaping using the h() function to both scalar and array values before they are inserted into the DOM. As a temporary mitigation, avoid using the taggedAttributes and galaxyAttachedAttributes parameters in the event attribute filtering query builder.