Vulnerability Description
MISP contains a reflected cross-site scripting vulnerability in the UiBeta event index view. The urlparams value is inserted into an inline JavaScript handler using HTML escaping inside a single-quoted JavaScript string. Because browsers HTML-decode attribute values before JavaScript parsing, a crafted searcheventinfo value can restore encoded quote characters and break out of the JavaScript string. An attacker could craft a malicious URL that, when opened by a victim using the UiBeta event index, executes arbitrary JavaScript in the victim’s browser in the context of the MISP instance. The issue is fixed by encoding the value as a JavaScript string literal with json_encode() before applying HTML escaping at the attribute layer.
Related Weaknesses (CWE)
References
FAQ
What is CVE-2026-54395?
CVE-2026-54395 is a documented vulnerability. MISP contains a reflected cross-site scripting vulnerability in the UiBeta event index view. The urlparams value is inserted into an inline JavaScript handler using HTML escaping inside a single-quote...
How severe is CVE-2026-54395?
CVSS scoring is not yet available for CVE-2026-54395. Check NVD for updates.
Is there a patch for CVE-2026-54395?
Check the references section above for vendor advisories and patch information. Review vendor security bulletins for remediation guidance.