MISP CVE-2025-67906

Requires (1) an authenticated MISP account with permissions to create or edit workflow nodes - typically users assigned a workflow-capable role on a MISP instance with the Workflows feature enabled (PR:L), (2) a second victim user with workflow-viewing rights to visit the workflow execution path page that renders the malicious node, satisfying UI:R, and (3) the target instance running MISP < 2.5.28 with the default doT.js client-side rendering of executionPath.ctp. Exploitation is limited by the need for two distinct user actions (inject, then victim-view) and by deployments that have disabled workflows or restricted workflow-editing roles to administrators only.

The CVSS 3.1 vector (AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:H = 9.0) reflects a stored XSS where a low-privileged attacker (PR:L) abuses workflow-creation rights and waits for another user - typically an admin reviewing workflows - to load the page (UI:R), with scope change because injected script executes in the victim browser session and can pivot across MISP's authorization boundary. EPSS is not provided and the CVE is not on CISA KEV, so there is no evidence of mass exploitation; however, the franckferman GitHub repositories referenced in NVD strongly suggest publicly available proof-of-concept code, raising opportunistic risk for internet-exposed MISP instances. Real-world priority is high for any multi-tenant MISP deployment (community/sharing-group setups) where untrusted analysts hold workflow privileges, and moderate for single-tenant internal instances.

An attacker with a low-privileged MISP account that can create or edit workflow nodes inserts JavaScript into a workflow node's name or icon field; when an administrator later opens the workflow execution path view to inspect or debug the workflow, the payload executes in the admin's browser under the MISP origin. The attacker uses the hijacked admin session to exfiltrate threat-intel data, create new admin accounts, or pivot via MISP's REST API. Publicly available exploit code in researcher GitHub repositories reduces the skill required to weaponize this issue.