MISP CVE-2026-94373

Exploitation requires: (1) an authenticated MISP account or a data-sharing peer able to influence values rendered by the ContextualMenu JavaScript class (the option text drawn from value.text or value); (2) a victim who is an authenticated MISP user and who opens the contextual menu that renders the attacker-controlled data (UI:P / user interaction). This is a DOM-based XSS in app/webroot/js/contextual_menu.js confined to the MISP application origin. Limiting factors: attacker needs at least low-privilege authenticated access (PR:L), the payload only fires when a victim actively opens the affected menu, and impact is bounded to the browser session rather than direct server compromise. Fixed in MISP 2.5.47.

The CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:L/UI:P) describes a network-reachable DOM-based XSS requiring an authenticated (PR:L) MISP user and passive victim interaction (UI:P). The vendor scores it 6.3 (medium) by placing all impact in the subsequent-system metrics (SC:H/SI:H) rather than the vulnerable system (VC:N/VI:N/VA:N) - a defensible XSS framing where the executing browser/session is treated as a separate impacted system. No EPSS score, no CISA KEV listing, and no public exploit code are present in the input, so this is 'no public exploit identified at time of analysis' - a real but not urgent priority. The key gating factors keep real-world risk moderate: an attacker must first influence data that gets rendered into a contextual menu, and a victim analyst must view that menu. Because MISP is a shared threat-intelligence platform where multiple organizations feed data, the 'attacker-influenced data' condition is realistic (stored/second-order XSS via shared events/attributes), which raises practical concern above a pure self-XSS. The source-code diff (innerHTML → textContent) confirms the root cause exactly as described, giving high confidence in the vulnerability's authenticity.

An authenticated MISP user (or a peer instance sharing data) supplies a malicious string containing HTML/JavaScript in a field that later populates a contextual-menu <option> via innerHTML. When another authenticated analyst opens that contextual menu in the MISP UI, the injected script executes in the MISP origin, enabling session hijacking, data exfiltration, or actions on the victim's behalf. No public exploit code is identified, but the fix commit precisely confirms the vulnerable innerHTML assignment.