{"id":"CVE-2026-112184","revision":"09978d395d6d44928288d52c42ac9498","records":[{"revision":"09978d395d6d44928288d52c42ac9498","observedAt":"2026-10-23T15:48:27.903+00:00","statement":{"source":"cve-program","id":"CVE-2026-112184","aliases":[],"title":"MISP Workflow Module: Reflected XSS via Unescaped misp-modules Parameter Names in Form Labels","description":"MISP contains a reflected cross-site scripting (XSS) vulnerability in the workflow module interface. Parameter names returned by the misp-modules service are rendered as raw HTML form labels on the workflow module page without output encoding. An attacker who can influence the parameter names reported by the misp-modules service can inject arbitrary HTML or JavaScript that executes in the context of an authenticated MISP user's browser.\n\nPreconditions:\n\n- The attacker must be able to control or influence parameter names reported by the misp-modules service.\n\n- A victim must be authenticated and view the affected workflow module page.\n\nImpact:\n\n- Execution of arbitrary JavaScript in the victim's browser session.\n\n- Potential theft of session tokens, manipulation of the MISP interface, or initiation of unauthorized actions on behalf of the victim.\n\nAffected versions: <2.5.48.","state":0,"publishedAt":"2026-10-19T09:19:45.056+00:00","modifiedAt":"2026-10-19T17:14:52.401+00:00","affected":[{"ecosystem":"Vendor product","name":"MISP","ranges":[],"versions":[],"rawVersionEvidence":"{\n                    \"cpes\": [\n                        \"cpe:2.3:a:misp:misp:*:*:*:*:*:*:*:*\"\n                    ],\n                    \"modules\": [\n                        \"Workflow Modules (Module_misp_module)\"\n                    ],\n                    \"product\": \"MISP\",\n                    \"programFiles\": [\n                        \"app/Model/WorkflowModules/Module_misp_module.php\"\n                    ],\n                    \"repo\": \"https://github.com/MISP/MISP\",\n                    \"vendor\": \"MISP\",\n                    \"versions\": [\n                        {\n                            \"lessThan\": \"2.5.48\",\n                            \"status\": \"affected\",\n                            \"version\": \"0\",\n                            \"versionType\": \"semver\"\n                        }\n                    ]\n                }"}],"metrics":[{"system":"CVSS 4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:A/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N","score":4.8,"severity":"MEDIUM"}],"references":["https://github.com/MISP/MISP/commit/813a48b2b"],"sourceUrl":"https://www.cve.org/CVERecord?id=CVE-2026-112184","license":"CVE Program Terms of Use","key":"cve-program:CVE-2026-112184","identifiers":["CVE-2026-112184"]},"retained":false,"historicalAffected":[]}],"coverage":[]}