Goal Reached Thanks to every supporter — we hit 100%!

Goal: 1000 CNY · Raised: 1359 CNY

100%
Buy Us a Coffee

CVE-2026-104906— MISP TAXII Object Viewer Stored XSS via Unescaped JSON Output

Quick assessment

Affected
MISP MISP
Exploitation
No confirmed in-the-wild exploitation; assess based on exposure
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.

MISP 中存在一个跨站脚本（XSS）漏洞，位于 TAXII 对象查看器中。当显示远程 TAXII 对象时，字符串属性的 JSON 内容未经 HTML 编码直接渲染到 HTML 的 标签中。攻击者若能控制或影响 TAXII 对象的内容（例如，向受害者 MISP 实例订阅的 TAXII 服务器发布恶意对象），则可在受害者 MISP 会话上下文中注入并执行任意 HTML 或 JavaScript 代码。 前提条件： 受害者必须是已认证的 MISP 用户，并具有访问 TAXII 对象查看器的权限。 受害者必须打开或查看构

CVSS 6.2 · Medium EPSS 0.36% · P27

Affected Version Matrix 1

VendorProduct Version RangeStatus
MISP MISP < 2.5.48 affected
Get alerts for future matching vulnerabilities Log in to subscribe

I. Basic Information for CVE-2026-104906

Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗

Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.

Vulnerability Title
MISP TAXII Object Viewer Stored XSS via Unescaped JSON Output
Source: CVE Program / CVE List V5
Vulnerability Description
MISP contains a cross-site scripting (XSS) vulnerability in the TAXII object viewer. When displaying a remote TAXII object, the JSON content of string properties was rendered directly into an HTML pre block without HTML-encoding. An attacker who can control or influence the content of a TAXII object (e.g., by publishing a malicious object to a TAXII server that the victim's MISP instance subscribes to) can inject arbitrary HTML or JavaScript that executes in the context of the victim's MISP session. Preconditions: - The victim must be an authenticated MISP user with access to the TAXII object viewer. - The victim must open or view the crafted TAXII object. Impact: - Execution of arbitrary JavaScript in the victim's browser within the MISP application context. - Potential theft of session tokens, API keys, or other sensitive data accessible from the MISP interface. - Potential for performing actions on behalf of the authenticated user. Affected versions: <2.5.48.
Source: CVE Program / CVE List V5
CVSS Information
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:A/VC:N/VI:N/VA:N/SC:H/SI:H/SA:N
Source: CVE Program / CVE List V5
Vulnerability Type
在Web页面生成时对输入的转义处理不恰当(跨站脚本)
Source: CVE Program / CVE List V5

Affected Products

Vendor Product Affected Versions CPE Subscribe
MISP MISP 0 ~ 2.5.48 cpe:2.3:a:misp:misp:*:*:*:*:*:*:*:*

II. Public POCs for CVE-2026-104906

# POC Description Source Link Shenlong Link
AI-Generated POC Premium

No public POC found.

Login to generate AI POC

III. Intelligence Information for CVE-2026-104906

请登录查看更多情报信息。

Patches & Fixes for CVE-2026-104906 (1)

Same Patch Batch · MISP · 2026-10-02 · 8 CVEs total

CVE-2026-104908 7.1 HIGH MISP Decaying Model Import Mass Assignment Allows Cross-Organization Model Overwrite and D
CVE-2026-104912 7.1 HIGH MISP Correlation Authorization Bypass Exposes Restricted Event and Attribute Data
CVE-2026-104900 5.3 MEDIUM MISP Stored XSS via Unescaped Count Field Value in Remote Event Preview Index
CVE-2026-104910 5.3 MEDIUM MISP Information Disclosure via Related Events Listing Bypassing Per-Event Authorization
CVE-2026-104914 5.3 MEDIUM MISP: Soft-Deleted Attributes from Other Organizations Exposed via Attribute Search and Pa
CVE-2026-104901 5.1 MEDIUM MISP ID Translator: Unescaped Remote Event ID Enables Cross-Site Scripting via Linked Serv
CVE-2026-104907 4.8 MEDIUM MISP: JavaScript Injection via Remote Tag ID in Event Preview Inline Handler

IV. Related Vulnerabilities

Same product: MISP
Same vendor: MISP
Same weakness: CWE-79

V. Comments for CVE-2026-104906

No comments yet

Leave a comment