Goal Reached Thanks to every supporter — we hit 100%!

Goal: 1000 CNY · Raised: 1359 CNY

100%

Buy Us a Coffee

CVE-2026-95665— MISP Reflected Cross-Site Scripting in Event Export Confirmation Form via Unescaped JSON

Quick assessment

Affected

MISP MISP

Exploitation

No confirmed in-the-wild exploitation; assess based on exposure

Recommended action

Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.

MISP 中的事件 REST 搜索导出确认表单存在一个反射型跨站脚本（XSS）漏洞。视图模板使用 PHP 的函数将一个由 URL 提供的事件 ID 列表渲染为单引号包裹的 JavaScript 字符串字面量，但未使用任何十六进制编码标志。默认情况下，仅转义双引号和反斜杠，而不会转义单引号。由于该 JavaScript 字符串使用单引号作为分隔符，攻击者可以注入单引号字符来终止字符串字面量，从而在受害者的浏览器会话中执行任意 JavaScript 代码。该漏洞影响 Default 和 UiBeta 主题，这两

CVSS 5.1 · Medium EPSS 0.54% · P46 Updated Sep 23, 2026

Possible ATT&CK Techniques 1 AI

T1059.007 · JavaScript

Affected Version Matrix 1

Vendor	Product	Version Range	Status
MISP	MISP	`< 2.5.47`	affected

Get alerts for future matching vulnerabilities Log in to subscribe

Vulnerability Information

Have questions about the vulnerability? See if Shenlong's analysis helps!

View Shenlong Deep Dive ↗

Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.

Vulnerability Title

MISP Reflected Cross-Site Scripting in Event Export Confirmation Form via Unescaped JSON

Source: CVE Program / CVE List V5

Vulnerability Description

MISP contains a reflected cross-site scripting (XSS) vulnerability in the event REST search export confirmation form. The view template app/View/Events/ajax/eventRestSearchExportConfirmationForm.ctp renders a URL-supplied event ID list into a single-quoted JavaScript string literal using PHP's json_encode() without any hex-encoding flags. By default, json_encode() escapes double quotes and backslashes but does not escape single quotes. Because the JavaScript string is delimited by single quotes, an attacker can inject a single-quote character to terminate the string literal and execute arbitrary JavaScript in the victim's browser session. The vulnerability affects the Default and UiBeta themes, both of which render this view. The Overmind theme's own copy of the form already passed the value through an escaped data attribute and was not affected by this specific sink. Preconditions: the victim must be an authenticated MISP user and must actively open or navigate to the attacker-crafted URL. The attacker does not require an account or any prior access to the MISP instance. Security impact: successful exploitation allows execution of arbitrary JavaScript in the context of the MISP web application, potentially leading to session hijacking, unauthorized actions performed on behalf of the victim, exfiltration of sensitive data visible in the session, or further client-side attacks. The vulnerable component's own confidentiality, integrity, and availability are not directly compromised; the impact is on the underlying user session.

Source: CVE Program / CVE List V5

CVSS Information

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:L/VI:L/VA:N/SC:L/SI:L/SA:N

Source: CVE Program / CVE List V5

Vulnerability Type

在Web页面生成时对输入的转义处理不恰当(跨站脚本)

Source: CVE Program / CVE List V5

Affected Products

Vendor	Product	Affected Versions	CPE	Subscribe
MISP	MISP	0 ~ 2.5.47	-

II. Public POCs for CVE-2026-95665

#	POC Description	Source Link	Shenlong Link

AI-Generated POC Premium

No public POC found.

III. Intelligence Information for CVE-2026-95665

请登录查看更多情报信息。

Patches & Fixes for CVE-2026-95665 (1)

🔗 fix: [security] Escape the event id list in the export confirmation form · MISP/MISP@ad4ff23 · GitHub patch

https://www.cve.org/CVERecord?id=CVE-2026-95665

Same Patch Batch · MISP · 2026-09-22 · 19 CVEs total

CVE-2026-95806	7.7 HIGH	MISP: PHP phar stream wrapper enables deserialization and code execution via caller-influe
CVE-2026-95658	6.9 MEDIUM	MISP CSRF vulnerability in workflow moduleStatelessExecution allows cross-site execution o
CVE-2026-95754	6.9 MEDIUM	MISP: Disabled-user check ineffective in pre-authentication TOTP login branch
CVE-2026-95679	6.9 MEDIUM	MISP Unauthenticated Blind SSRF via XML Body Processing
CVE-2026-95667	6.9 MEDIUM	MISP Installer Log and FIFO Created World-Readable, Exposing Sensitive Credentials
CVE-2026-95697	5.3 MEDIUM	MISP: Insufficient Authorization Allows Sharing Group Editors to Overwrite Organization Me
CVE-2026-95805	5.3 MEDIUM	MISP ACLComponent: Typo in previewEventAttributes ACL key bypasses intended access restric
CVE-2026-95698	5.3 MEDIUM	MISP Path Traversal in OrgImgHelper findOrgImage via Crafted Organization Name
CVE-2026-95671	5.3 MEDIUM	MISP Collections: Missing Authorization Check for Sharing Group on PUT Request in collecti
CVE-2026-95693	5.3 MEDIUM	MISP Information Disclosure via Forged Upload Path
CVE-2026-95674	5.3 MEDIUM	MISP EventsController queryEnrichment allows querying unavailable or legacy modules withou
CVE-2026-95683	5.3 MEDIUM	MISP Overmind Event View Discloses Report Content Bypassing Report-Level ACL
CVE-2026-95685	5.3 MEDIUM	MISP Missing Authorization on replaceSuggestionInReport Event Report Action
CVE-2026-95661	5.1 MEDIUM	MISP Reflected Cross-Site Scripting in Attribute Histogram via Unescaped URL-Supplied Type
CVE-2026-95703	5.1 MEDIUM	MISP OrganisationsController File Existence and Image-Type Oracle via Forged Upload tmp_na
CVE-2026-95701	5.1 MEDIUM	MISP Path Traversal via Organization Name in Org-Statistics Logo Check
CVE-2026-95659	4.8 MEDIUM	MISP Reflected XSS via Unvalidated Object Type in AnalystData Overmind Thread
CVE-2026-95682	4.8 MEDIUM	MISP Stored Cross-Site Scripting via Unescaped Organization Name in Admin Email View

IV. Related Vulnerabilities

Same product: MISP

Same vendor: MISP

Same weakness: CWE-79