MISP EUVD-2026-89800

Exploitation requires (1) an authenticated MISP account with permission to create or modify an event graph entry, so the attacker can store a malicious preview_img value in the EventGraph model, and (2) a second, victim user who opens that event graph and hovers to trigger the preview popover, at which point event-graph.js concatenates the stored value directly into an img src attribute and executes injected script. It is specifically limited to instances running MISP versions prior to the fix commit applied after v2.5.48; the required prior authentication (PR:L) and mandatory victim interaction (UI:P) are the principal factors limiting real-world exploitation, making internet-exposed multi-user MISP deployments the realistic risk surface.

This is a genuine but bounded stored-XSS risk. The vendor CVSS 4.0 vector (CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:P/VC:N/VI:H/VA:N/SC:H/SI:H/SA:N, 8.3 High) drives its score from a scope change and high integrity impact on the subsequent system (the victim's authenticated browser session), which is standard for XSS that runs in another user's context. Two mitigating signals temper the raw score: PR:L means the attacker must already hold an authenticated MISP account with rights to create/modify an event graph entry, and UI:P means a second privileged victim must actually open the event graph and trigger the preview popover. There is no EPSS score, no CISA KEV listing, and no public proof-of-concept in the provided data - so this is no public exploit identified at time of analysis, not active exploitation. The fix is confirmed by a real vendor commit (MISP/MISP@92c7ccc43) that both adds server-side base64-PNG validation and switches the client from string concatenation to jQuery .prop('src'), so the root cause and patch are well-established. Net: a real, patchable issue worth prioritizing on internet-exposed or multi-tenant MISP instances, but not an unauthenticated drive-by - closer to a medium operational priority than the 8.3 headline suggests.

An authenticated MISP user with event-graph edit rights stores a crafted preview_img value that breaks out of the img src attribute and injects script. When another MISP user later views that event graph and hovers to trigger the preview popover, the injected JavaScript executes in the victim's authenticated session, enabling theft of session cookies/tokens or actions performed as the victim. No public PoC or exploit code is identified in the provided data.