CVE-2026-54395 MISP UiBeta event index reflected XSS in advanced filter popup
Reflected XSS in MISP UiBeta event index allows attackers to execute arbitrary JavaScript in victim browsers via crafted URLs.
- Exploited in the wild
- Not known
- Login needed
- Any signed-in user
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2026-54395?
CVE-2026-54395 is a medium-severity cross-site scripting vulnerability in misp, published on 12 Jun 2026. Any signed-in user can exploit it over the network, with no action from the victim.
Official description
MISP contains a reflected cross-site scripting vulnerability in the UiBeta event index view. The urlparams value is inserted into an inline JavaScript handler using HTML escaping inside a single-quoted JavaScript string. Because browsers HTML-decode attribute values before JavaScript parsing, a crafted searcheventinfo value can restore encoded quote characters and break out of the JavaScript string. An attacker could craft a malicious URL that, when opened by a victim using the UiBeta event index, executes arbitrary JavaScript in the victim’s browser in the context of the MISP instance. The issue is fixed by encoding the value as a JavaScript string literal with json_encode() before applying HTML escaping at the attribute layer.
Weakness: CWE-79
Which versions are affected by CVE-2026-54395?
How do I fix CVE-2026-54395?
No fix has been published for CVE-2026-54395 yet. Limit exposure of the affected software until one is available.
Escape output for the context it lands in and set a strict Content Security Policy. Upgrading the affected component is the real fix. More about Cross-site scripting.
Is CVE-2026-54395 being exploited?
There is no known exploitation of CVE-2026-54395 in the wild and no public exploit code.
Sources
Also known as GHSA-53gc-pj4j-m2pq.