MISP CVE-2026-104906

Exploitation requires all of the following: (1) the victim's MISP instance subscribes to a TAXII server whose object content the attacker can publish to or influence; (2) the attacker crafts a TAXII object whose string properties contain HTML/JavaScript payloads; and (3) an authenticated MISP user (PR:L) with access to the TAXII object viewer must actively open/view that specific crafted object (UI:A required). Limiting factors: this is not remote-unauthenticated - the victim session must be logged in, user interaction is mandatory, and the attacker must sit within or compromise a TAXII feed the target trusts. These constraints make exploitation targeted rather than opportunistic, though versions below 2.5.48 in default configuration are vulnerable once those conditions are met.

This is a medium-severity stored/reflected XSS (CWE-79) in MISP's TAXII object viewer, rated 6.2 by the vendor using a CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:L/UI:A/VC:N/VI:N/VA:N/SC:H/SI:H/SA:N). The vector signals are internally consistent and realistic: network vector with low complexity, but exploitation is gated by two real constraints - PR:L means the victim session is an authenticated MISP user, and UI:A means the victim must actively open/view the malicious object. The high subsequent-system impact (SC:H/SI:H) correctly reflects that injected JavaScript runs in the victim's authenticated MISP browser context, enabling session/API-key theft and actions-on-behalf, while the vulnerable system itself shows no direct C/I/A impact (VC/VI/VA:N). No EPSS score, KEV listing, or public POC was provided in the input; exploitation status is therefore 'no public exploit identified at time of analysis.' The practical priority is moderate rather than urgent: exploitation requires the attacker to influence content on a TAXII feed the target MISP actually subscribes to AND requires a logged-in analyst to view the crafted object, so this is a targeted, trust-chain-abuse scenario rather than mass-exploitable. A vendor patch exists and the one-line fix (wrapping json_encode output in MISP's h() HTML-encoder) is confirmed by the referenced commit, so remediation is straightforward and should be applied, but this does not rise to drop-everything emergency status absent evidence of active exploitation.

An attacker publishes a malicious TAXII object whose string properties embed HTML/JavaScript to a TAXII server that a victim organization's MISP instance subscribes to. When an authenticated MISP analyst opens that remote object in the TAXII object viewer, the unencoded JSON is rendered into the <pre> block and the script executes in their session, allowing theft of session tokens or API keys. No public exploit code was identified in the provided data, but the fix commit publicly reveals the exact sink.