CVE-2026-103321
Gravedad CVSS v4.0:
ALTA
Tipo:
CWE-20
Validación incorrecta de entrada
Fecha de publicación:
30/09/2026
Última modificación:
30/09/2026
Descripción
*** Pendiente de traducción *** MISP contains a stored cross-site script (XSS) vulnerability in the event graph preview feature.<br />
<br />
The event graph preview image field was accepted and stored without server-side validation. On the client side, the stored value was rendered into an HTML img element&#39;s src attribute via string concatenation, allowing a crafted value to break out of the attribute context and inject arbitrary script.<br />
<br />
Preconditions:<br />
<br />
- An authenticated MISP user with the ability to create or modify an event graph entry.<br />
<br />
- A second user (the victim) who views the event graph and triggers the preview popover.<br />
<br />
Impact:<br />
<br />
- Execution of arbitrary JavaScript in the victim&#39;s browser within the MISP application context.<br />
<br />
- Potential theft of session tokens, cookies, or sensitive data accessible to the victim&#39;s browser.<br />
<br />
- Potential for performing actions on behalf of the victim within the MISP application.<br />
<br />
Affected: MISP versions prior to the fix (commit applied after v2.5.48).
Impacto
Puntuación base 4.0
8.30
Gravedad 4.0
ALTA