MISP CVE-2026-93296

Requires the MISP Overmind theme to be active and a victim to view the affected statistics views - the event General card (event_general.ctp) or the server/feed preview card (preview_general.ctp) whose donut-chart legend renders object/category names. The attacker must hold authenticated MISP access with permission to create or rename an object (attribute name, event name, or server/feed identifier) that surfaces in the legend (PR:L), and a separate victim must open the affected Overmind page (UI:P). Limiting factors: authentication is required, the non-default Overmind theme must be in use, exploitation depends on victim interaction, and impact scales with the victim's privilege level (an admin viewer yields the greatest impact). No special browser conditions or race conditions are needed.

This is a genuine but moderate-priority issue. The vendor CVSS 4.0 score of 8.5 is driven by VC:H/VI:H, but the independent signals temper that: EPSS is only 0.33% (26th percentile), CISA SSVC rates Exploitation as 'none', Automatable as 'no', and Technical Impact as only 'partial', and there is no KEV listing. This is a stored XSS (CWE-79) requiring PR:L (an authenticated user with permission to create/rename objects) plus UI:P (a victim must view the Overmind dashboard) - so it is not a mass-exploitable, unauthenticated RCE. The 8.5 rating appears high relative to the SSVC 'partial technical impact' and low EPSS, indicating a high-CVSS-but-moderate-real-risk profile rather than an urgent widespread threat. No public exploit was identified, though the fixing commit (382188d2f) publicly discloses the exact vulnerable innerHTML concatenation, lowering the bar to reproduce. The VC:H/VI:H vendor rating is defensible if the victim is an admin (session hijack enabling account takeover), but for a typical viewer the practical impact is closer to Low - a point worth verifying against your MISP role model. Overall: patch in normal cadence; not an emergency given authentication gating, required user interaction, and absence of active exploitation.

A low-privileged but authenticated MISP user creates or renames an object (attribute, event, or feed/server identifier) whose name embeds a script tag or event-handler attribute. When another user - ideally an administrator - opens the Overmind theme's event General card or server/feed preview card, the donut-chart legend renders the name via innerHTML without HTML-encoding, executing the attacker's JavaScript in the MISP application origin. No public exploit code was identified, but the patch commit reveals the exact injection point, and no special browser conditions or races are required.