CVE-2026-85227 Reflected Cross-Site Scripting in MISP Event Filtering via taggedAttributes and galaxyAttachedAttributes Parameters
Reflected XSS in MISP allows attackers to execute JavaScript via crafted URLs, potentially accessing or modifying victim data.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- A user has to click or open something
- Fix
- None listed
What is CVE-2026-85227?
CVE-2026-85227 is a medium-severity cross-site scripting vulnerability in Misp-Project Misp, published on 3 Sep 2026. An attacker can exploit it over the internet without logging in, and only if a user opens a file or follows a link.
Official description
MISP contains a reflected Cross-Site Scripting (XSS) vulnerability in the event attribute filtering query builder. The taggedAttributes and galaxyAttachedAttributes URL parameters were inserted into the query-builder rules without HTML escaping before being serialized as JSON and embedded inside a <script> element.
Because JsonTool::encode() uses JSON_UNESCAPED_SLASHES, an attacker-controlled value containing a closing </script> sequence could terminate the surrounding script element and inject arbitrary HTML or JavaScript. For example, a specially crafted viewEventAttributes URL could contain malicious content in one of the affected filter parameters.
An attacker could exploit the vulnerability by convincing an authenticated MISP user to follow a crafted URL. Successful exploitation would execute attacker-controlled JavaScript in the security context of the MISP instance and with the privileges of the victim's authenticated browser session. This could allow access to information available to the victim, modification of data through authenticated requests, or other actions permitted by the victim's MISP permissions.
The vulnerability is addressed by applying HTML escaping with h() to both scalar and array values before they are inserted into the DOM.
Weakness: CWE-79
Which versions are affected by CVE-2026-85227?
It affects 1 product.
Products include Misp-Project Misp.
How do I fix CVE-2026-85227?
No fix has been published for CVE-2026-85227 yet. Limit exposure of the affected software until one is available.
Escape output for the context it lands in and set a strict Content Security Policy. Upgrading the affected component is the real fix. More about Cross-site scripting.
Is CVE-2026-85227 being exploited?
There is no known exploitation of CVE-2026-85227 in the wild and no public exploit code.
Other vulnerabilities in Misp-Project Misp
Sources
Also known as GHSA-mj6h-p8f5-39rh.