MISP EUVD-2026-89964

Exploitation requires the attacker to hold galaxy editor privileges either on the local MISP instance or on any instance that synchronizes to the target (the sync path is the key amplifier, since clusters propagate between federated instances). The attacker stores a javascript:-scheme string in a Galaxy Cluster's 'source' field, which pre-2.5.48 MISP renders as a clickable <a href> whenever PHP's FILTER_VALIDATE_URL accepts it - and FILTER_VALIDATE_URL does accept javascript: URIs. Exploitation is LIMITED by two factors: it is authenticated (galaxy editor role, PR:L, so not open to anonymous attackers) and it demands active victim interaction - the victim must both open the affected cluster view and click the rendered link (UI:A), not merely load a page. Only MISP versions below 2.5.48 are affected; the fix adds an ^https?:// scheme allowlist.

This is a stored XSS (CWE-79) in MISP that carries a real but conditional risk profile. The vendor CVSS 4.0 vector (CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:A/VC:N/VI:N/VA:N/SC:H/SI:H/SA:N, 6.2) correctly reflects the two gating factors: the attacker needs galaxy editor privileges (PR:L) and the victim must both view the cluster AND actively click the malicious link (UI:A / Active user interaction). No EPSS score, KEV listing, SSVC decision, or public POC is present in the input, so exploitation status is 'no public exploit identified at time of analysis' - this is not a drop-everything emergency. The genuine severity driver is the injection sink itself, which is unambiguously confirmed by the vendor commit: FILTER_VALIDATE_URL accepts the javascript: scheme, and the old code emitted the source verbatim into an href. The vendor rates the subsequent-system (browser) confidentiality/integrity impact as High (SC:H/SI:H) because session hijacking is plausible; I regard High as somewhat aggressive for a typical stored-XSS payload and would rate it Low, but the direction is correct. The trust-federation angle raises the effective risk beyond the raw score: MISP instances routinely sync galaxy clusters from peers, so a malicious cluster authored on one instance propagates to all synced instances, widening the victim pool without the attacker needing local editor rights on each target. Net: a legitimate patch-soon priority for MISP operators, not a mass-exploitation-grade flaw.

An attacker holding galaxy editor privileges on a MISP instance - or on any instance that syncs to the target - creates or edits a Galaxy Cluster and sets its 'source' field to a javascript: URL. The cluster synchronizes to peer instances, and when an analyst on a victim instance opens the cluster view and clicks the rendered 'source' link, the embedded script executes in their authenticated MISP session, enabling session hijacking, data exfiltration, or actions taken as that user. No public exploit code is identified in the provided data, though the vendor commit fully reveals the vulnerable pattern.