CVE-2026-104906: MISP TAXII Object Viewer XSS Vulnerability

CVE-2026-104906 Overview

CVE-2026-104906 is a stored cross-site scripting (XSS) vulnerability in the Malware Information Sharing Platform (MISP) TAXII object viewer. The flaw affects MISP versions prior to 2.5.48. When the TAXII object viewer renders a remote object, it writes the JSON content of string properties directly into an HTML <pre> block without HTML-encoding. An attacker who publishes a crafted TAXII object to a server that a victim's MISP instance subscribes to can inject arbitrary HTML or JavaScript. The payload executes in the authenticated victim's browser within the MISP application context.

Critical Impact
Arbitrary JavaScript executes in the victim's MISP session, enabling theft of session tokens, API keys, and actions performed on behalf of the authenticated user.

Affected Products

MISP versions earlier than 2.5.48
MISP TAXII object viewer component (app/View/Elements/genericElements/json.ctp)
MISP instances subscribed to untrusted or compromised TAXII feeds

Discovery Timeline

2026-10-02 - CVE-2026-104906 published to the National Vulnerability Database (NVD)
2026-10-02 - Last updated in NVD database

Technical Details for CVE-2026-104906

Vulnerability Analysis

The vulnerability is a stored cross-site scripting (XSS) issue classified under [CWE-79]. The TAXII object viewer in MISP calls json_encode() on object property values and places the result inside an HTML <pre> element without encoding HTML metacharacters. Because json_encode() does not escape characters such as <, >, and " for HTML contexts, attacker-controlled string content inside a TAXII object can break out of the surrounding markup. The injected script executes with the privileges of the authenticated MISP user viewing the object.

Successful exploitation lets an attacker read session cookies, exfiltrate API keys exposed in the MISP interface, and submit authenticated requests to the MISP API. In threat-intelligence sharing environments, the attack also enables lateral propagation across federated instances that pull from the same TAXII source.

Root Cause

The root cause is missing output encoding in the generic JSON rendering element. The template concatenated raw json_encode() output into HTML markup, treating JSON output as safe for HTML display. JSON encoding and HTML encoding serve different purposes, and the former does not neutralize characters that terminate HTML tags or attributes.

Attack Vector

Exploitation requires that an attacker influence TAXII content ingested by the victim MISP instance and that an authenticated MISP user open the crafted object in the viewer. User interaction is required, but no attacker credentials on the MISP instance itself are needed.

text

// Patch diff from app/View/Elements/genericElements/json.ctp
     echo sprintf(
         '<pre id="%s">%s</pre>',
         $randomId,
-        json_encode($json)
+        h(json_encode($json))
     );
 ?>

Source: MISP commit 1bed4ca0c

The fix wraps json_encode($json) with CakePHP's h() helper, which performs HTML entity encoding on the output before it reaches the <pre> element.

Detection Methods for CVE-2026-104906

Indicators of Compromise

TAXII objects containing HTML tags such as <script>, <img onerror=...>, or inline event handlers inside string property values
MISP audit log entries showing API key reads, user record access, or event modifications originating from browser sessions shortly after a TAXII object view
Outbound HTTP requests from analyst browsers to unknown domains immediately following access to an ingested TAXII object

Detection Strategies

Inspect ingested STIX/TAXII payloads for raw HTML or JavaScript constructs in string fields before rendering
Review MISP web server access logs for /events/viewEventAttributes or TAXII viewer routes correlated with suspicious authenticated API activity
Enable Content Security Policy (CSP) violation reporting to surface inline script execution attempts in the MISP UI

Monitoring Recommendations

Alert on new or modified TAXII feed subscriptions, particularly from unvetted upstream providers
Monitor MISP user sessions for anomalous API key regeneration or privileged action sequences
Track outbound DNS and HTTP traffic from workstations used by MISP analysts for data exfiltration patterns

How to Mitigate CVE-2026-104906

Immediate Actions Required

Upgrade MISP to version 2.5.48 or later, which includes commit 1bed4ca0c
Audit all configured TAXII feed subscriptions and remove untrusted sources until the upgrade is applied
Rotate MISP user API keys and session secrets if the TAXII viewer was used against untrusted content prior to patching

Patch Information

The upstream fix is available in the MISP GitHub commit 1bed4ca0c, which applies the CakePHP h() escaping helper to JSON output in app/View/Elements/genericElements/json.ctp. Deploy MISP release 2.5.48 or newer to incorporate the fix.

Workarounds

Restrict TAXII subscriptions to trusted, authenticated providers only
Limit access to the TAXII object viewer to a small set of trained analysts through MISP role permissions
Deploy a strict Content Security Policy that forbids inline scripts and unknown script sources in the MISP web application

bash

# Example: upgrade MISP to the patched release
cd /var/www/MISP
sudo -u www-data git fetch --tags
sudo -u www-data git checkout v2.5.48
sudo -u www-data git submodule update --init --recursive
sudo systemctl restart apache2