CVE-2026-93296

Name of the Vulnerable Software and Affected Versions MISP (affected versions not specified)

Description A stored cross-site scripting (XSS) issue exists in the Overmind theme's statistics views. The event General card (event general.ctp) and the server/feed preview card (preview general.ctp) create donut chart legend labels by concatenating object names or category keys into an innerHTML string without HTML-encoding. An authenticated user with permissions to create or modify objects can craft a name containing malicious markup. When another user views the affected Overmind dashboard, this markup is executed as JavaScript in the victim's browser, potentially leading to session hijacking, data exfiltration, or unauthorized actions.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.