{"id":"CVE-2026-104906","revision":"ae86628403e8470eb8de86f8df8c7ff9","records":[{"revision":"ae86628403e8470eb8de86f8df8c7ff9","observedAt":"2026-10-23T15:48:27.903+00:00","statement":{"source":"cve-program","id":"CVE-2026-104906","aliases":[],"title":"MISP TAXII Object Viewer Stored XSS via Unescaped JSON Output","description":"MISP contains a cross-site scripting (XSS) vulnerability in the TAXII object viewer. When displaying a remote TAXII object, the JSON content of string properties was rendered directly into an HTML pre block without HTML-encoding. An attacker who can control or influence the content of a TAXII object (e.g., by publishing a malicious object to a TAXII server that the victim's MISP instance subscribes to) can inject arbitrary HTML or JavaScript that executes in the context of the victim's MISP session.\n\nPreconditions:\n\n- The victim must be an authenticated MISP user with access to the TAXII object viewer.\n\n- The victim must open or view the crafted TAXII object.\n\nImpact:\n\n- Execution of arbitrary JavaScript in the victim's browser within the MISP application context.\n\n- Potential theft of session tokens, API keys, or other sensitive data accessible from the MISP interface.\n\n- Potential for performing actions on behalf of the authenticated user.\n\nAffected versions: <2.5.48.","state":0,"publishedAt":"2026-10-02T15:49:32.948+00:00","modifiedAt":"2026-10-02T16:17:21.73+00:00","affected":[{"ecosystem":"Vendor product","name":"MISP","ranges":[],"versions":[],"rawVersionEvidence":"{\n                    \"cpes\": [\n                        \"cpe:2.3:a:misp:misp:*:*:*:*:*:*:*:*\"\n                    ],\n                    \"modules\": [\n                        \"TAXII object viewer\",\n                        \"app/View/Elements/genericElements/json.ctp\"\n                    ],\n                    \"product\": \"MISP\",\n                    \"programFiles\": [\n                        \"app/View/Elements/genericElements/json.ctp\"\n                    ],\n                    \"repo\": \"https://github.com/MISP/MISP\",\n                    \"vendor\": \"MISP\",\n                    \"versions\": [\n                        {\n                            \"lessThan\": \"2.5.48\",\n                            \"status\": \"affected\",\n                            \"version\": \"0\",\n                            \"versionType\": \"semver\"\n                        }\n                    ]\n                }"}],"metrics":[{"system":"CVSS 4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:A/VC:N/VI:N/VA:N/SC:H/SI:H/SA:N","score":6.2,"severity":"MEDIUM"}],"references":["https://github.com/MISP/MISP/commit/1bed4ca0c"],"sourceUrl":"https://www.cve.org/CVERecord?id=CVE-2026-104906","license":"CVE Program Terms of Use","key":"cve-program:CVE-2026-104906","identifiers":["CVE-2026-104906"]},"retained":false,"historicalAffected":[]}],"coverage":[]}