MISP EUVD-2026-84377

Exploitation requires the victim to be an authenticated MISP user who actively opens or navigates to an attacker-crafted URL (UI:A/UI:R) targeting the event REST-search export confirmation form (eventRestSearchExportConfirmationForm.ctp). The attacker needs no MISP account or prior access. The instance must run the Default or UiBeta theme - the Overmind theme is NOT vulnerable to this sink because its copy of the form already passes the value through an escaped data attribute. Only unpatched builds (before commit ad4ff238d) are affected. The limiting factors are: mandatory victim interaction, the victim being logged in, and the non-Overmind theme requirement.

This is a genuine but bounded, low-to-medium priority issue. The CVSS 4.0 base of 5.1 (AV:N/AC:L/AT:N/PR:N/UI:A/VC:L/VI:L/VA:N/SC:L/SI:L) correctly captures a reflected XSS: network-reachable and low-complexity, but critically dependent on victim interaction (UI:A/UI:R) - the attacker must lure an already-authenticated MISP user into clicking a crafted URL. No EPSS score, KEV listing, POC, or SSVC decision data was provided, so there is no evidence of active or automatable exploitation; per the precision rules this is 'no public exploit identified at time of analysis.' The signal set is therefore weak-but-consistent: no data conflicts, but also no amplifiers. The impact metrics are deliberately low (VC:L/VI:L) because the vulnerable component's own confidentiality/integrity are not compromised - the damage is confined to the victim's browser session. The single most important limiting factor is the authenticated-victim + user-interaction requirement, which keeps real-world risk modest despite the network vector. Note the vendor 4.0 score of 5.1 slightly under-weights the session-context boundary crossing; an equivalent CVSS 3.1 rating would land near 6.1 (S:C) since the payload executes across the session/application trust boundary. Patch availability (single confirmed vendor commit) makes remediation trivial and further lowers effective risk.

An unauthenticated attacker crafts a URL to the MISP event REST-search export confirmation form with an event ID list parameter containing a single-quote plus JavaScript payload, then phishes an authenticated MISP analyst into opening it. Because json_encode() does not escape single quotes by default, the payload breaks out of the single-quoted JS string literal and runs in the victim's session, enabling session hijacking or actions performed as the victim. No public exploit code was identified, but the injection is trivially reproducible from the described sink and the vendor commit diff.