MISP CVE-2026-94372

Exploitation requires: (1) the attacker to already hold tag-editor-level privileges on the MISP instance in order to create a crafted misp-galaxy tag (PR:L); (2) the malicious tag to be surfaced as an unknown custom or default galaxy cluster sample during synchronization; (3) the instance to be running the DEFAULT theme - the Overmind theme already HTML-escapes these values and is not affected; and (4) a site administrator to subsequently view the Galaxies index page (UI:P). Limiting factors: authenticated privileged access is needed, exploitation is confined to the default theme, victim interaction by an administrator is mandatory, and impact is limited to the administrator's browser session with no direct server-process compromise. Affected versions are MISP <2.5.47.

This is a genuine but bounded stored XSS. The vendor CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:L/UI:P) correctly captures that exploitation is network-reachable but authenticated (PR:L, requires tag-editor privileges) and gated on victim interaction (UI:P - a site administrator must open the Galaxies index page in the default theme). Notably the vector sets vulnerable-system impact to none (VC:N/VI:N/VA:N) and places all impact on the subsequent system (SC:H/SI:H) - i.e. the administrator's browser session, not the MISP server process, which matches the description's own statement that 'the impact is limited to the administrator's browser session and does not directly compromise the MISP server process.' I regard SC:H/SI:H as somewhat inflated for a session-scoped XSS; C:L/I:L is more defensible. There is no EPSS score, no CISA KEV listing, and no public POC referenced - exploitation status is therefore 'no public exploit identified at time of analysis.' There is no SSVC decision content supplied. Net: a real, patch-worthy admin-targeting XSS but not an emergency - it is a low-real-risk, privilege-and-interaction-gated issue rather than a mass-exploitable flaw. The single most important mitigating fact is that an attacker must already hold tag-editor access on the instance.

A user with tag-editor privileges on a MISP instance crafts a malicious misp-galaxy tag whose name contains script markup. During synchronization the instance flags the tag as an unknown custom/default galaxy cluster, and when a site administrator later views the Galaxies index page in the default theme the unescaped sample tag name executes in the admin's browser, allowing session-data theft or actions performed as the administrator. No public POC is referenced, though the fix commit clearly identifies the unescaped sink.