CVE-2026-103664: MISP Reflected XSS Vulnerability

CVE-2026-103664 Overview

CVE-2026-103664 is a reflected cross-site scripting (XSS) vulnerability in the MISP (Malware Information Sharing Platform) analyst data notes panel. The seed path parameter supplied via the URL was passed directly into inline JavaScript within the rendered HTML response without sanitization or type enforcement. An authenticated MISP user who follows a crafted link can trigger execution of attacker-controlled JavaScript in their browser session. The flaw is tracked under CWE-79 and was fixed in MISP commit 58925dbf0, released after version v2.5.48.

Critical Impact
An attacker who lures an authenticated MISP user to a crafted URL can execute arbitrary JavaScript in the victim's browser, enabling session token theft, interface manipulation, and actions performed on behalf of the victim.

Affected Products

MISP versions prior to commit 58925dbf0
MISP releases up to and including v2.5.48
The AttributesController and ObjectsController analyst data views

Discovery Timeline

2026-10-01 - CVE-2026-103664 published to NVD
2026-10-01 - Last updated in NVD database

Technical Details for CVE-2026-103664

Vulnerability Analysis

The vulnerability resides in the MISP analyst data notes panel rendered by AttributesController and ObjectsController. The controllers accept a user-controlled seed value from the URL and pass it unchanged into the view layer. The view embeds the value inside inline JavaScript, which executes when the page renders.

Because the application performs no sanitization, encoding, or type enforcement on the seed parameter, an attacker can break out of the intended JavaScript literal and inject arbitrary script. The injected script runs in the victim's authenticated session context, giving it access to session cookies, CSRF tokens, and any data visible in the MISP interface.

Exploitation requires an authenticated victim and user interaction, which aligns with the reported reflected XSS pattern. Successful execution allows the attacker to exfiltrate credentials, pivot into other MISP actions, or manipulate analyst-facing content displayed by the notes panel.

Root Cause

The root cause is missing input validation and output encoding in the controller-to-view data flow. The seed variable, intended to represent a numeric seed, was treated as an opaque string and emitted directly into inline JavaScript. The absence of type casting allowed non-numeric payloads to be rendered as executable script.

Attack Vector

The attacker crafts a URL to an analyst data view for an attribute or object with a malicious seed path segment. The attacker then delivers the URL to an authenticated MISP user through phishing, chat, or another social channel. When the victim loads the URL, the server reflects the payload into inline JavaScript and the browser executes it.

php

// Patch in app/Controller/AttributesController.php
        $this->layout = null;
        $this->set('shortDist', $this->MispAttribute->shortDist);
        $this->set('object', $attribute[0]['Attribute']);
-        $this->set('seed', $seed);
+        $this->set('seed', (int)$seed ?: mt_rand());
    }

    public function enrich($id)
// Source: https://github.com/MISP/MISP/commit/58925dbf0

The fix casts $seed to an integer before passing it to the view, falling back to mt_rand() when the cast yields zero. This enforces a numeric type and eliminates the injection primitive. An identical change was applied in app/Controller/ObjectsController.php.

Detection Methods for CVE-2026-103664

Indicators of Compromise

Web server access logs showing requests to analyst data view endpoints in AttributesController or ObjectsController with non-numeric seed path segments.
URL path components containing JavaScript syntax such as </script>, alert(, document.cookie, or encoded variants like %3Cscript%3E.
Unexpected outbound requests from MISP user browsers to attacker-controlled domains shortly after loading an analyst data URL.

Detection Strategies

Deploy web application firewall (WAF) rules that reject requests to MISP analyst data endpoints when the seed segment is not strictly numeric.
Review MISP audit logs for authenticated sessions that performed anomalous actions immediately after loading analyst data views.
Inspect email, chat, and ticketing systems for inbound links pointing at MISP analyst data endpoints with suspicious path parameters.

Monitoring Recommendations

Monitor HTTP request paths matching the pattern /attributes/* and /objects/* for seed values containing non-digit characters.
Alert on Content Security Policy (CSP) violation reports originating from MISP analyst data pages.
Track user-agent and referer anomalies on analyst data endpoints to identify phishing-driven navigation.

How to Mitigate CVE-2026-103664

Immediate Actions Required

Upgrade MISP to a build that includes commit 58925dbf0 or any release published after v2.5.48.
Rotate MISP user session tokens and API keys for accounts that may have followed untrusted links to analyst data views.
Communicate to MISP users to avoid clicking externally supplied links that target /attributes/ or /objects/ paths until patched.

Patch Information

The upstream fix is available in MISP commit 58925dbf0. The patch casts the seed value to an integer in both AttributesController.php and ObjectsController.php, falling back to mt_rand() when the cast evaluates to zero. Apply the official MISP release that bundles this commit rather than hand-patching production systems.

Workarounds

Place MISP behind a reverse proxy or WAF rule that rejects requests where the seed URL segment contains any non-digit character.
Enforce a strict Content Security Policy that disallows inline script execution to reduce the impact of reflected injection.
Restrict MISP access to trusted networks and require users to open MISP links only from the authenticated dashboard.

bash

# Example NGINX rule to block non-numeric seed values on analyst data routes
location ~ ^/(attributes|objects)/.+ {
    if ($arg_seed ~ "[^0-9]") { return 400; }
    if ($request_uri ~* "/(attributes|objects)/[^/]+/[^/]*[^0-9/][^/]*$") { return 400; }
    proxy_pass http://misp_backend;
}