MISP CVE-2026-95661

Exploitation requires the victim to be an authenticated MISP user who actively navigates to an attacker-supplied URL for the attribute histogram view, where the type path segment carries the payload; the attacker needs no MISP account (PR:N) but cannot exploit without victim interaction (UI:A/UI:R). Limiting factors: the payload only fires within an authenticated session, requires successful social engineering to get the victim to click, is scoped to the MISP application origin, and is fully neutralized on instances running the build containing commit 95b8f21f6 (json_encode with HEX escaping flags).

This is a genuine but bounded vulnerability. The vendor-supplied CVSS 4.0 vector (5.1, medium) shows a network-reachable reflected XSS with no attacker privileges required (PR:N) but mandatory active user interaction (UI:A) and only Low confidentiality/integrity impact on both the vulnerable system (VC:L/VI:L) and a subsequent system (SC:L/SI:L), reflecting the cross-origin nature of XSS. No EPSS score, no CISA KEV listing, and no public proof-of-concept were provided, so this is not a demonstrated priority for opportunistic attackers. The code diff confirms the flaw is real and specific: the fix commit (95b8f21f6) replaces a raw PHP foreach that emitted $selectedTypes values into a JavaScript array literal with a properly encoded json_encode() call using JSON_HEX_TAG/APOS/QUOT/AMP flags - so this is verified source-level, not merely claimed. Note the tension between PR:N and the description's requirement that the victim be an authenticated MISP user: this is correct for reflected XSS (the ATTACKER needs no account; the VICTIM must be logged in and click), and UI:A/UI:R captures that gate. Real-world risk is moderate and targeted rather than mass-exploitable, because success depends on socially engineering a specific authenticated user to open a crafted URL.

An attacker crafts a MISP histogram URL whose type path segment contains a JavaScript payload and sends it (phishing/chat/watering hole) to a logged-in MISP analyst. When the analyst opens the link, the unescaped $selectedTypes value breaks out of the onClick JavaScript array literal and executes in the MISP origin, letting the attacker read session cookies, act as the victim, or exfiltrate threat-intel data visible in the interface. No public exploit code was identified at time of analysis, though the fix commit reveals the exact injection point.