MISP EUVD-2026-90577

Exploitation requires ALL of the following: (1) the target MISP instance must have the legacy taxonomy tag confirmation views (add_tag / disable_tag forms) enabled; (2) the victim must be an authenticated MISP site administrator with an active session; and (3) that administrator must be induced to click an attacker-crafted URL whose tag name parameter contains a JavaScript payload (UI:A - active user interaction). The attacker needs no credentials or prior access to the instance (PR:N), but cannot self-trigger the payload - it executes only in the targeted admin's browser, making successful phishing the primary limiting factor. Versions 2.5.48 and later are not affected (output is escaped via h()).

This is a genuine but low-to-moderate priority issue whose real-world risk is tempered by several limiting factors rather than an exploitable-at-scale flaw. The CVSS 4.0 vector (AV:N/AC:L/PR:N/UI:A/VC:L/VI:L/VA:N, 5.1 Medium) tells a consistent story with the description: network-reachable and low-complexity, but gated on active user interaction (UI:A) by a specific, high-value victim - an authenticated MISP site administrator who must be social-engineered into clicking an attacker-crafted URL. No EPSS score, KEV listing, or public POC was provided, so there is no public exploit identified at time of analysis and no evidence of active exploitation; the signals are internally consistent (no conflict between CVSS and description). The confidentiality/integrity impacts are rated Low because a reflected XSS yields script execution in one administrator's browser session, not direct server compromise - though for a threat-intelligence platform, theft of an admin session/CSRF token and subsequent privileged actions in the MISP UI is a meaningful secondary consequence the base score arguably understates. Note the CVSS 4.0 vector keeps subsequent-system impact at N (SC:N/SI:N), whereas a CVSS 3.1 model of the same XSS would typically set S:C; this is a framework-modeling difference, not a data conflict. Net: patch promptly, but this is not an internet-wide mass-exploitation candidate given the admin-click precondition.

An attacker crafts a URL to a victim MISP instance's legacy taxonomy 'add tag' or 'disable tag' confirmation form with a malicious tag name parameter containing JavaScript, then phishes a logged-in MISP site administrator into clicking it. The unescaped tag name is reflected into the rendered HTML and executes in the administrator's authenticated session, allowing session/CSRF token theft or privileged actions in the MISP UI. No public POC was provided, but the one-line fix (wrapping the value in CakePHP's h() escaping helper) confirms the trivially reproducible root cause.