CVE-2026-103321
MISP Stored Cross-Site Scripting (XSS) via Unvalidated Event Graph Preview Image
Description
MISP contains a stored cross-site script (XSS) vulnerability in the event graph preview feature. The event graph preview image field was accepted and stored without server-side validation. On the client side, the stored value was rendered into an HTML img element's src attribute via string concatenation, allowing a crafted value to break out of the attribute context and inject arbitrary script. Preconditions: - An authenticated MISP user with the ability to create or modify an event graph entry. - A second user (the victim) who views the event graph and triggers the preview popover. Impact: - Execution of arbitrary JavaScript in the victim's browser within the MISP application context. - Potential theft of session tokens, cookies, or sensitive data accessible to the victim's browser. - Potential for performing actions on behalf of the victim within the MISP application. Affected: MISP versions prior to the fix (commit applied after v2.5.48).
INFO
Published Date :
Sept. 30, 2026, 12:19 p.m.
Last Modified :
Sept. 30, 2026, 12:19 p.m.
Remotely Exploit :
Yes !
Source :
CIRCL
Affected Products
The following products are affected by CVE-2026-103321
vulnerability.
Even if cvefeed.io is aware of the exact versions of the
products
that
are
affected, the information is not represented in the table below.
No affected product recoded yet
CVSS Scores
| Score | Version | Severity | Vector | Exploitability Score | Impact Score | Source |
|---|---|---|---|---|---|---|
| CVSS 4.0 | HIGH | 5a6e4751-2f3f-4070-9419-94fb35b644e8 |
Solution
- Update MISP to a version after v2.5.48.
- Apply the security fix commit.
- Validate server-side input for event graph images.
- Sanitize client-side rendered image sources.
We scan GitHub repositories to detect new proof-of-concept exploits. Following list is a collection of public exploits and proof-of-concepts, which have been published on GitHub (sorted by the most recently updated).
Results are limited to the first 15 repositories due to potential performance issues.
The following list is the news that have been mention
CVE-2026-103321 vulnerability anywhere in the article.