Is there a patch available for CVE-2026-54395?

Yes, a patch is available for CVE-2026-54395. Update the affected software to the latest version immediately.

MISP CVE-2026-54395

Q: What is the CVSS score of CVE-2026-54395?

CVE-2026-54395 has a CVSS 4.0 base score of 5.3 (Medium). CVSS vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.1%.

EUVD-2026-36564 MEDIUM

Cross-site Scripting (XSS) (CWE-79)

2026-06-12 CIRCL

GHSA-53gc-pj4j-m2pq

XSS Misp

5.3

CVSS 4.0 · Vendor: CIRCL

Severity by source

Vendor (CIRCL) PRIMARY

5.3 MEDIUM

CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

vuln.today AI

5.4 MEDIUM

Reflected XSS requires victim to follow crafted link (UI:R); PR:L matches authenticated MISP context; S:C because JavaScript executes in victim's browser under MISP origin.

3.1 AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N

4.0 AV:N/AC:L/AT:N/PR:L/UI:P/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N

Primary rating from Vendor (CIRCL).

CVSS VectorVendor: CIRCL

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Lifecycle Timeline

Source Code Evidence Fetched

Jun 12, 2026 - 21:25 vuln.today

Analysis Generated

Jun 12, 2026 - 21:25 vuln.today

DescriptionCVE.org

MISP contains a reflected cross-site scripting vulnerability in the UiBeta event index view. The urlparams value is inserted into an inline JavaScript handler using HTML escaping inside a single-quoted JavaScript string. Because browsers HTML-decode attribute values before JavaScript parsing, a crafted searcheventinfo value can restore encoded quote characters and break out of the JavaScript string. An attacker could craft a malicious URL that, when opened by a victim using the UiBeta event index, executes arbitrary JavaScript in the victim’s browser in the context of the MISP instance. The issue is fixed by encoding the value as a JavaScript string literal with json_encode() before applying HTML escaping at the attribute layer.

AnalysisAI

Reflected XSS in MISP's UiBeta event index view allows an authenticated attacker to execute arbitrary JavaScript in a victim's browser by crafting a malicious URL with a specially encoded searcheventinfo parameter. The vulnerability exploits a double-encoding flaw: the PHP template applies only HTML escaping (h()) to the urlparams value placed inside a single-quoted JavaScript string in an onclick attribute, but browsers HTML-decode attribute values before JavaScript parsing - restoring encoded quote characters (' → ') and enabling string breakout. No public exploit code has been identified at time of analysis, and the fix has been committed upstream by the MISP maintainers at CIRCL.

Technical ContextAI

MISP is a CakePHP-based open-source threat intelligence sharing platform (CPE: cpe:2.3:a:misp:misp:*:*:*:*:*:*:*:*). The vulnerable code resides in app/View/Themed/UiBeta/Events/index.ctp, a CakePHP view template for the UiBeta theme's event listing page. The root cause is CWE-79 (Improper Neutralization of Input During Web Page Generation): the developer applied PHP's h() HTML-escaping function to the $urlparams value and embedded it directly inside a single-quoted JavaScript string literal within an HTML onclick attribute. The browser's HTML parser, which processes attribute values before the JavaScript engine sees them, decodes HTML entities - converting ' back to a literal single quote - enabling an attacker-controlled value to terminate the JavaScript string and inject arbitrary code. The correct fix, applied in commit b865deb, uses json_encode() to first construct a properly escaped JavaScript string literal (which uses backslash-escaping, not HTML entities), then wraps it with h() for the HTML attribute layer: h(json_encode($urlparams)).

RemediationAI

The primary remediation is to apply the upstream fix from commit b865deb036ca82dab272be260798f562034ba9ae (https://github.com/MISP/MISP/commit/b865deb036ca82dab272be260798f562034ba9ae), which replaces h($urlparams) with h(json_encode($urlparams)) in app/View/Themed/UiBeta/Events/index.ctp. No specific tagged release version containing this fix was identified in the available data - operators should verify whether their installed version post-dates this commit by checking the git log of their deployment. As a workaround where immediate patching is not possible, administrators can disable the UiBeta theme and revert users to the default MISP interface, which does not contain the vulnerable code path; note that this removes access to UiBeta-specific UI features. Additionally, restricting the ability for users to share or distribute internal MISP URLs externally reduces the social engineering surface through which a crafted link would be delivered to a victim.