CVE-2026-53693— BSimVis 跨站脚本漏洞

MISP BSimVis stored cross-site scripting in tag and cluster rendering paths via unescaped tag metadata and UI labels

A stored cross-site scripting vulnerability existed in MISP BSimVis tag rendering code. Several client-side rendering paths interpolated tag names, collection names, entity identifiers, cluster names, and tag metadata directly into HTML, HTML attributes, inline JavaScript event handlers, and CSS style values without context-appropriate escaping. The patch adds shared escaping helpers for HTML, attributes, JavaScript strings, and CSS color validation, then applies them across tag badges, tooltips, context menus, cluster cards, autocomplete suggestions, and dynamically inserted tag cards. An attacker able to create or influence stored tag or metadata values could inject a crafted payload that is later rendered in another user’s browser. Successful exploitation could execute arbitrary JavaScript in the victim’s session when they view affected BSimVis pages, potentially allowing the attacker to perform actions as the victim, read data available to the victim, or alter displayed application content. This issue affects MISP bsimvis: through v0.2.0.

N/A

在Web页面生成时对输入的转义处理不恰当(跨站脚本)

BSimVis 跨站脚本漏洞

BSimVis是MISP Project开源的一个二进制程序相似性分析与可视化工具。 BSimVis v0.2.0及之前版本存在跨站脚本漏洞，该漏洞源于允许攻击者以受害者身份执行操作、读取受害者可访问的数据或更改显示的应用程序内容。

N/A

N/A