Vulnerability Description
MISP's galaxy matrix statistics view (app/View/Users/statistics_galaxymatrix.ctp) renders the galaxy name directly into HTML output via sprintf() without any HTML encoding. An authenticated user holding the perm_galaxy_editor permission can create or modify a galaxy whose name contains arbitrary HTML or JavaScript markup. Because the value is interpolated verbatim into the page, any user who subsequently opens the galaxy matrix statistics page will have the embedded script executed in their browser context. This enables session hijacking, credential theft, data exfiltration, or the performance of arbitrary actions on behalf of the victim within the MISP application. Version affected: <2.5.47
Related Weaknesses (CWE)
References
FAQ
What is CVE-2026-94277?
CVE-2026-94277 is a documented vulnerability. MISP's galaxy matrix statistics view (app/View/Users/statistics_galaxymatrix.ctp) renders the galaxy name directly into HTML output via sprintf() without any HTML encoding. An authenticated user holdi...
How severe is CVE-2026-94277?
CVSS scoring is not yet available for CVE-2026-94277. Check NVD for updates.
Is there a patch for CVE-2026-94277?
Check the references section above for vendor advisories and patch information. Review vendor security bulletins for remediation guidance.