MISP EUVD-2026-104142

Exploitation requires that the attacker can control or influence the parameter names returned by a misp-modules service (e.g., a malicious, attacker-supplied, or compromised workflow/enrichment module) - the injected payload rides in the module's parameter names, not in a user-supplied URL, so a simple crafted link is not sufficient. It further requires a victim who is an authenticated MISP user and who actively navigates to and views the affected workflow module configuration page (UI:A). Limiting factors: attacker must already have influence over the misp-modules service, the victim must be authenticated and take a specific UI action, and only MISP versions before 2.5.48 are affected; patched instances encode the label via h() and are not exploitable.

This is a medium-severity (CVSS 4.0 base 4.8), not a top-priority, vulnerability, and the signals are internally consistent. The vendor CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:L/UI:A/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N) describes a network-reachable but authentication- and interaction-gated reflected XSS: the attacker needs PR:L (some privilege to influence the misp-modules service) and the victim must be an authenticated user who actively views the affected page (UI:A). There is no direct confidentiality/integrity/availability impact on the MISP server itself (VC:N/VI:N/VA:N); impact is confined to the subsequent system - the victim's browser session (SC:L/SI:L). No EPSS score, no CISA KEV listing, and no public exploit code are present in the provided data, so there is no public exploit identified at time of analysis and no evidence of active or widespread exploitation. The most important nuance is the unusual precondition: unlike typical reflected XSS where any attacker crafts a malicious URL, here the injection vector is the parameter names returned by the misp-modules service, meaning the attacker must already be able to control or influence that service's responses - a meaningful barrier that makes opportunistic mass exploitation unlikely and points toward targeted or chained scenarios. Net: real but modest risk, appropriately prioritized below critical/network-unauthenticated issues; patch in routine cycles.

An attacker who can control or influence the parameter names reported by a misp-modules service (for example via a malicious, compromised, or attacker-supplied module) injects an HTML/JavaScript payload into a parameter name. When an authenticated MISP user opens the workflow module configuration page, the unescaped name is rendered as a raw form label and the script executes in their session, enabling session-token theft or unauthorized actions in the MISP UI. No public exploit code is identified at time of analysis, and exploitation requires both the attacker's control over module parameter names and victim interaction.