CVE-2026-104907: MISP Remote Event Preview XSS Vulnerability

CVE-2026-104907 Overview

CVE-2026-104907 is a cross-site scripting (XSS) vulnerability in MISP, the open-source Malware Information Sharing Platform. The flaw resides in the remote event preview page, where tag identifiers from a linked (remote) MISP server are rendered inside an inline JavaScript onclick attribute. The tag ID value was HTML-escaped but not sanitized for the JavaScript string context. A malicious linked server can supply a tag ID containing a single quote to break out of the string literal and inject arbitrary script [CWE-79].

Critical Impact
Arbitrary JavaScript executes in the viewing user's browser session, enabling session hijacking, data exfiltration, or unauthorized actions against the local MISP instance.

Affected Products

MISP versions prior to v2.5.48
MISP instances configured with linked/remote servers
Deployments where authenticated users browse remote event previews

Discovery Timeline

2026-10-02 - CVE-2026-104907 published to NVD
2026-10-02 - Last updated in NVD database

Technical Details for CVE-2026-104907

Vulnerability Analysis

The vulnerability affects app/View/Servers/preview_event.ctp, which renders event tags received from a remote MISP server. The template builds a clickable tag element whose onclick handler constructs a URL using the tag ID directly from the remote server response. The developer applied the h() helper, which performs HTML entity encoding, but HTML encoding does not neutralize characters that terminate a JavaScript string literal within an inline event handler.

Because the tag ID is rendered inside single-quoted JavaScript, a value containing a single quote escapes the string context. Everything that follows is parsed as JavaScript. The attacker-controlled MISP server is the injection source, so exploitation requires that a local administrator has federated with a server under adversary control or that an adversary has compromised a trusted peer. An authenticated local user viewing the event preview and clicking the tag triggers execution.

Root Cause

The root cause is context-confused output encoding. HTML escaping was applied where JavaScript string escaping (or type casting to integer) was required. Tag IDs are numeric database identifiers and should never contain non-digit characters, so the correct fix is strict type coercion rather than string sanitization.

Attack Vector

Exploitation requires a linked remote MISP server, a crafted tag ID in a shared event, and user interaction with the affected tag element in the preview UI. The injected script runs with the authenticated user's session cookies and MISP permissions.

text

// Patch diff: app/View/Servers/preview_event.ctp
 ob_start();
 if (!empty($event['Tag'])): foreach ($event['Tag'] as $tag): ?>
 <span style="padding-right:0;">
-    <span role="button" tabindex="0" ... onclick="document.location.href='<?= $baseurl . "/servers/previewIndex/" . h($server['Server']['id']); ?>/searchtag:<?= h($tag['id']); ?>';" ...>
+    <span role="button" tabindex="0" ... onclick="document.location.href='<?= $baseurl . "/servers/previewIndex/" . h($server['Server']['id']); ?>/searchtag:<?= (int)$tag['id']; ?>';" ...>
 </span>
 <?php endforeach; endif;
 $tags = ob_get_clean();

Source: MISP commit 70ad174dd. The fix replaces h($tag['id']) with (int)$tag['id'], forcing the value to an integer and eliminating any possibility of injecting non-numeric characters into the JavaScript context.

Detection Methods for CVE-2026-104907

Indicators of Compromise

Non-numeric characters (quotes, parentheses, angle brackets) appearing in tag ID fields received from remote MISP sync.
Browser console errors or unexpected script execution on /servers/previewEvent/* pages.
Outbound requests from analyst browsers to unexpected domains following remote event preview activity.

Detection Strategies

Inspect the local MISP database for tags rows synced from remote servers that contain non-integer id values or anomalous payload patterns.
Review web server access logs for /servers/previewIndex/*/searchtag:* requests containing URL-encoded quotes or script tokens.
Correlate authenticated MISP session activity with anomalous outbound HTTP requests from analyst workstations.

Monitoring Recommendations

Audit all configured remote MISP servers under Sync Actions and verify each peer is a trusted source.
Enable and monitor MISP audit logs for Server and Event fetch operations referencing untrusted peers.
Deploy a Content Security Policy (CSP) that blocks inline script execution to reduce the blast radius of future XSS flaws.

How to Mitigate CVE-2026-104907

Immediate Actions Required

Upgrade MISP to v2.5.48 or later, which contains commit 70ad174dd.
Audit the list of linked remote MISP servers and disable sync with any peer that is not fully trusted.
Rotate authenticated user API keys and session tokens if preview pages were accessed with untrusted peers configured.

Patch Information

The upstream fix is commit 70ad174dd in the MISP repository, which casts the remote tag ID to an integer in app/View/Servers/preview_event.ctp. See MISP commit 70ad174dd for the full diff. Operators should pull the latest stable release and redeploy their MISP instance.

Workarounds

Temporarily disable the remote event preview workflow by restricting the Servers controller to administrators only.
Remove or pause synchronization with untrusted remote MISP servers until the patch is applied.
Instruct analysts to avoid clicking tag elements on remote event preview pages until the upgrade is complete.

bash

# Upgrade MISP to the patched release
cd /var/www/MISP
sudo -u www-data git fetch origin
sudo -u www-data git checkout v2.5.48
sudo -u www-data git submodule update --init --recursive
sudo systemctl restart apache2