CVE-2026-94277 Details
Description
MISP's galaxy matrix statistics view (app/View/Users/statistics_galaxymatrix.ctp) renders the galaxy name directly into HTML output via sprintf() without any HTML encoding. An authenticated user holding the perm_galaxy_editor permission can create or modify a galaxy whose name contains arbitrary HTML or JavaScript markup. Because the value is interpolated verbatim into the page, any user who subsequently opens the galaxy matrix statistics page will have the embedded script executed in their browser context. This enables session hijacking, credential theft, data exfiltration, or the performance of arbitrary actions on behalf of the victim within the MISP application. Version affected: <2.5.47
A cross-site scripting vulnerability has been identified in the MISP application, specifically in the galaxy matrix statistics view. This issue arises because the galaxy name is rendered directly into the HTML output without proper encoding, allowing for the injection of arbitrary HTML or JavaScript. An authenticated user with the 'perm_galaxy_editor' permission can exploit this by creating or modifying a galaxy with a crafted name. When another user accesses the galaxy matrix statistics page, the injected script is executed in their browser, potentially leading to session hijacking, credential theft, data exfiltration, or unauthorized actions within the MISP application. This vulnerability affects versions prior to 2.5.47.
Users can upgrade to MISP version 2.5.47 or later, where this vulnerability has been addressed.
Metrics
CVSS 4.0 Severity and Vector Strings:
VolerionCVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
Volerion
Assessed Sep 21, 2026CISA-ADP
Assessed Sep 21, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://github.com/MISP/MISP/commit/6b7637bf4 | CIRCL | Source CodeVendor |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-79 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') | CIRCL |
Affected Products
| Product | Versions |
|---|---|
| MISP | < 2.5.47 (semver) |
CPE
Remediation
| |
Change History
2 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Sep 21, 2026 | CVE Modified | CISA-ADP |
| Sep 21, 2026 | New CVE Received | CIRCL |