GCVE-1-2026-20033 (CVE-2026-94373)
Vulnerability from gna-1 β Published: 2026-09-21 12:16 β Updated: 2026-09-21 12:16
VLAI
EPSS
VEX
Title
MISP DOM-based Cross-Site Scripting via innerHTML in Contextual Menu
Summary
MISP contains a DOM-based cross-site scripting (XSS) vulnerability in the contextual menu JavaScript component. The ContextualMenu class populates HTML <option> elements by assigning user-controllable values to the innerHTML property. Because innerHTML parses and renders HTML markup, any untrusted string supplied as the option text (value.text or value) is interpreted as live DOM content rather than plain text. An attacker who can influence the data rendered in the contextual menu can inject arbitrary HTML or JavaScript that executes in the victim's browser within the MISP application origin. This may allow session hijacking, data exfiltration, or unauthorized actions performed on behalf of the authenticated user.
Version affected: <2.5.47
Severity
CWE
- CWE-79 - Cross-site Scripting (XSS)
Assigner
GNA-1
This instance
References
1 reference
| URL | Tags |
|---|---|
| https://github.com/MISP/MISP/commit/b062698f2 | patch |
Impacted products
GCVE extensions
AI-generated
Confidence: medium
Model
qwen3.8:27b
advisory
bcp-05-x-01bcp-05-x-02
AI involvement
GCVE-BCP-05-X-01
Draft vulnerability metadata was generated from a git-format patch using an Ollama-hosted language model. Human validation is required before publication.
ai-computer-assisted:llm-generatedai-computer-assisted:classification
| Model | Source | Identifier |
|---|---|---|
| qwen3.8:27b | ollama | qwen3.8:27b |
Patch provenance
GCVE-BCP-05-X-02
- Generator
-
patch2vuln.pyon 2026-09-21 12:08 - Model
qwen3.8:27b- Input
-
https://github.com/MISP/MISP/commit/b062698f2.patch
843bc32d5dc3β¦ - Confidence
- medium
| Commit | Subject | Patch SHA-256 |
|---|---|---|
b062698f2699
|
fix: [xss] via JS innerHTML - as reported by David Andre and | 843bc32d5dc3β¦ |
Fix summary
The vulnerability is remediated by replacing the unsafe innerHTML property assignments with the safe textContent property when setting the display text of dynamically created <option> elements. textContent inserts the value as plain text without parsing HTML, thereby neutralizing any injected markup or script.
Patch summary
In app/webroot/js/contextual_menu.js, within the ContextualMenu class, two lines that set option.innerHTML (one for object-valued entries using value.text and one for scalar entries using value) are changed to option.textContent. No other logic, event handlers, or surrounding code is modified. The change is limited to the two assignment statements in the option-population loop.
CVSS rationale
AV:N: MISP is a network-accessible web application. AC:L: The injection is straightforward once attacker-controlled data reaches the menu options. AT:N: No special targeting of a specific session state is required beyond the data being rendered. PR:L: The attacker must be authenticated to MISP to inject data that will be rendered in the contextual menu. UI:P: The victim must interact with the contextual menu (e.g., open it) for the injected content to execute. VC/VI/VA:N: The MISP server itself is not directly compromised. SC:H/SI:H: The victim's browser (subsequent component) suffers high confidentiality and integrity impact via script execution in the MISP origin. SA:N: Availability of the browser is not impacted.
Weakness rationale
- CWE-79 The patch replaces innerHTML with textContent to prevent HTML/JS injection into the DOM, which is the canonical remediation for DOM-based XSS (CWE-79). The specific sub-type is DOM-based XSS via unsafe DOM API usage (innerHTML), but CWE-79 is the narrowest standard identifier that covers this.
Attack pattern rationale
- CAPEC-12 The vulnerability is a textbook DOM-based XSS: attacker-controlled data is written into the DOM via the innerHTML property, causing the browser to parse and execute injected markup/script. CAPEC-12 (DOM-based XSS) is the most precise CAPEC pattern. The mapping is high-confidence because the patch explicitly targets innerHTML-to-textContent in a client-side JS file, which is the defining characteristic of DOM-based XSS.
Assumptions to verify
- The affected version range is inferred from the tag_version_boundary (v2.5.47 with 137 commits after the fix), suggesting the fix landed shortly after v2.5.47; no explicit affected/fixed version strings are provided in the metadata.
- PR:L assumes the attacker must be an authenticated MISP user to inject data that reaches the contextual menu; if an unauthenticated injection path exists, PR could be N.
- UI:P assumes the victim must actively open or interact with the contextual menu for the XSS to trigger; if the menu renders automatically on page load, UI could be N.
- The CAPEC-12 mapping is high-confidence based on the innerHTML-to-textContent pattern, but the exact data flow (which upstream field feeds value.text) is not visible in the patch.
- AT:N assumes the attacker does not need to target a specific user's session; if the payload must be tailored to a particular user's view, AT could be P.
Model comparison
Selected qwen3.8:27b
by deterministic-consensus-v1
The selected result is closest to model consensus; this heuristic does not establish factual correctness and human review remains required.
| Model | Score | Agreement | Confidence | Assumptions |
|---|---|---|---|---|
qwen3.8:27b |
5 | 9 | medium | 5 |
{
"containers": {
"cna": {
"affected": [
{
"modules": [
"app/webroot/js/contextual_menu.js"
],
"product": "MISP",
"programFiles": [
"app/webroot/js/contextual_menu.js"
],
"repo": "https://github.com/MISP/MISP",
"vendor": "MISP",
"versions": [
{
"lessThan": "2.5.47",
"status": "affected",
"version": "0",
"versionType": "semver"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "remediation developer",
"value": "iglocska"
},
{
"lang": "en",
"type": "finder",
"value": "Jeroen Pinoy"
},
{
"lang": "en",
"type": "finder",
"value": "David Andre"
}
],
"descriptions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "\u003cp\u003eMISP contains a DOM-based cross-site scripting (XSS) vulnerability in the contextual menu JavaScript component. The ContextualMenu class populates HTML \u0026lt;option\u0026gt; elements by assigning user-controllable values to the innerHTML property. Because innerHTML parses and renders HTML markup, any untrusted string supplied as the option text (value.text or value) is interpreted as live DOM content rather than plain text. An attacker who can influence the data rendered in the contextual menu can inject arbitrary HTML or JavaScript that executes in the victim\u0027s browser within the MISP application origin. This may allow session hijacking, data exfiltration, or unauthorized actions performed on behalf of the authenticated user.\u003c/p\u003e\u003cp\u003eVersion affected: \u0026lt;2.5.47\u003c/p\u003e"
}
],
"value": "MISP contains a DOM-based cross-site scripting (XSS) vulnerability in the contextual menu JavaScript component. The ContextualMenu class populates HTML \u003coption\u003e elements by assigning user-controllable values to the innerHTML property. Because innerHTML parses and renders HTML markup, any untrusted string supplied as the option text (value.text or value) is interpreted as live DOM content rather than plain text. An attacker who can influence the data rendered in the contextual menu can inject arbitrary HTML or JavaScript that executes in the victim\u0027s browser within the MISP application origin. This may allow session hijacking, data exfiltration, or unauthorized actions performed on behalf of the authenticated user.\n\nVersion affected: \u003c2.5.47"
}
],
"impacts": [
{
"capecId": "CAPEC-12",
"descriptions": [
{
"lang": "en",
"value": "CAPEC-12 DOM-based XSS"
}
]
}
],
"metrics": [
{
"cvssV4_0": {
"Automatable": "NOT_DEFINED",
"Recovery": "NOT_DEFINED",
"Safety": "NOT_DEFINED",
"attackComplexity": "LOW",
"attackRequirements": "NONE",
"attackVector": "NETWORK",
"baseScore": 6.3,
"baseSeverity": "MEDIUM",
"privilegesRequired": "LOW",
"providerUrgency": "NOT_DEFINED",
"subAvailabilityImpact": "NONE",
"subConfidentialityImpact": "HIGH",
"subIntegrityImpact": "HIGH",
"userInteraction": "PASSIVE",
"valueDensity": "NOT_DEFINED",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:P/VC:N/VI:N/VA:N/SC:H/SI:H/SA:N",
"version": "4.0",
"vulnAvailabilityImpact": "NONE",
"vulnConfidentialityImpact": "NONE",
"vulnIntegrityImpact": "NONE",
"vulnerabilityResponseEffort": "NOT_DEFINED"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-79",
"description": "CWE-79 Cross-site Scripting (XSS)",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"orgId": "00000000-0000-4000-9000-000000000000"
},
"references": [
{
"name": "Security patch",
"tags": [
"patch"
],
"url": "https://github.com/MISP/MISP/commit/b062698f2"
}
],
"solutions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "\u003cp\u003eThe vulnerability is remediated by replacing the unsafe innerHTML property assignments with the safe textContent property when setting the display text of dynamically created \u0026lt;option\u0026gt; elements. textContent inserts the value as plain text without parsing HTML, thereby neutralizing any injected markup or script.\u003c/p\u003e"
}
],
"value": "The vulnerability is remediated by replacing the unsafe innerHTML property assignments with the safe textContent property when setting the display text of dynamically created \u003coption\u003e elements. textContent inserts the value as plain text without parsing HTML, thereby neutralizing any injected markup or script."
}
],
"title": "MISP DOM-based Cross-Site Scripting via innerHTML in Contextual Menu",
"x_gcve": [
{
"extensions": {
"bcp-05-x-01": {
"ai_annotations": [
{
"ai_level": "generated",
"description": "Draft vulnerability metadata was generated from a git-format patch using an Ollama-hosted language model. Human validation is required before publication.",
"gna_source": 1,
"models": [
{
"gna_source": 1,
"identifier": "qwen3.8:27b",
"name": "qwen3.8:27b",
"source": "ollama"
}
],
"review_status": "review",
"scope": "record",
"tags": [
"ai-computer-assisted:llm-generated",
"ai-computer-assisted:classification"
]
}
]
},
"bcp-05-x-02": {
"x_patch2vuln": {
"assumptions": [
"The affected version range is inferred from the tag_version_boundary (v2.5.47 with 137 commits after the fix), suggesting the fix landed shortly after v2.5.47; no explicit affected/fixed version strings are provided in the metadata.",
"PR:L assumes the attacker must be an authenticated MISP user to inject data that reaches the contextual menu; if an unauthenticated injection path exists, PR could be N.",
"UI:P assumes the victim must actively open or interact with the contextual menu for the XSS to trigger; if the menu renders automatically on page load, UI could be N.",
"The CAPEC-12 mapping is high-confidence based on the innerHTML-to-textContent pattern, but the exact data flow (which upstream field feeds value.text) is not visible in the patch.",
"AT:N assumes the attacker does not need to target a specific user\u0027s session; if the payload must be tailored to a particular user\u0027s view, AT could be P."
],
"capecRationale": [
{
"capecId": "CAPEC-12",
"rationale": "The vulnerability is a textbook DOM-based XSS: attacker-controlled data is written into the DOM via the innerHTML property, causing the browser to parse and execute injected markup/script. CAPEC-12 (DOM-based XSS) is the most precise CAPEC pattern. The mapping is high-confidence because the patch explicitly targets innerHTML-to-textContent in a client-side JS file, which is the defining characteristic of DOM-based XSS."
}
],
"commit": "b062698f269996ffe3ceb23de78612d768a3bfe2",
"confidence": "medium",
"credits": [
{
"lang": "en",
"type": "remediation developer",
"value": "iglocska"
}
],
"cvssRationale": "AV:N: MISP is a network-accessible web application. AC:L: The injection is straightforward once attacker-controlled data reaches the menu options. AT:N: No special targeting of a specific session state is required beyond the data being rendered. PR:L: The attacker must be authenticated to MISP to inject data that will be rendered in the contextual menu. UI:P: The victim must interact with the contextual menu (e.g., open it) for the injected content to execute. VC/VI/VA:N: The MISP server itself is not directly compromised. SC:H/SI:H: The victim\u0027s browser (subsequent component) suffers high confidentiality and integrity impact via script execution in the MISP origin. SA:N: Availability of the browser is not impacted.",
"draft": false,
"fixSummary": "The vulnerability is remediated by replacing the unsafe innerHTML property assignments with the safe textContent property when setting the display text of dynamically created \u003coption\u003e elements. textContent inserts the value as plain text without parsing HTML, thereby neutralizing any injected markup or script.",
"generatedAt": "2026-09-21T12:08:13.810140Z",
"generator": "patch2vuln.py",
"model": "qwen3.8:27b",
"modelComparison": {
"rankings": [
{
"agreementScore": 9,
"assumptionCount": 5,
"confidence": "medium",
"model": "qwen3.8:27b",
"score": 5
}
],
"selectedModel": "qwen3.8:27b",
"selectionMethod": "deterministic-consensus-v1",
"selectionNotice": "The selected result is closest to model consensus; this heuristic does not establish factual correctness and human review remains required."
},
"patchSha256": "843bc32d5dc337c115c79558f499550f4659a063b250fca808e32725cd586c9f",
"patchSummary": "In app/webroot/js/contextual_menu.js, within the ContextualMenu class, two lines that set option.innerHTML (one for object-valued entries using value.text and one for scalar entries using value) are changed to option.textContent. No other logic, event handlers, or surrounding code is modified. The change is limited to the two assignment statements in the option-population loop.",
"patchTruncated": false,
"patches": [
{
"commit": "b062698f269996ffe3ceb23de78612d768a3bfe2",
"patchSha256": "843bc32d5dc337c115c79558f499550f4659a063b250fca808e32725cd586c9f",
"source": "https://github.com/MISP/MISP/commit/b062698f2.patch",
"sourceUrl": "https://github.com/MISP/MISP/commit/b062698f2.patch",
"subject": "fix: [xss] via JS innerHTML - as reported by David Andre and"
}
],
"source": "https://github.com/MISP/MISP/commit/b062698f2.patch",
"subject": "fix: [xss] via JS innerHTML - as reported by David Andre and",
"tagVersionBoundary": {
"commits_after_fix": 137,
"repository": "https://github.com/MISP/MISP",
"tag": "v2.5.47",
"version": "2.5.47",
"version_type": "semver"
},
"weaknessRationale": [
{
"cweId": "CWE-79",
"rationale": "The patch replaces innerHTML with textContent to prevent HTML/JS injection into the DOM, which is the canonical remediation for DOM-based XSS (CWE-79). The specific sub-type is DOM-based XSS via unsafe DOM API usage (innerHTML), but CWE-79 is the narrowest standard identifier that covers this."
}
]
}
}
},
"recordType": "advisory",
"vulnId": "GCVE-1-2026-20033"
}
]
}
},
"cveMetadata": {
"assignerOrgId": "00000000-0000-4000-9000-000000000000",
"cveId": "CVE-2026-94373",
"datePublished": "2026-09-21T12:16:38.409984Z",
"dateReserved": "2026-09-21T12:16:44.364Z",
"dateUpdated": "2026-09-21T12:16:44.442452Z",
"state": "PUBLISHED",
"vulnId": "GCVE-1-2026-20033"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
Loadingβ¦
Loadingβ¦
Experimental. This forecast is provided for visualization only and may change without notice. Do not use it for operational decisions.
Forecast uses a logistic model when the trend is rising, or an exponential decay model when the trend is falling. Fitted via linearized least squares.
Sightings
| Author | Source | Type | Date | Other |
|---|
Nomenclature
- Seen: The vulnerability was mentioned, discussed, or observed by the user.
- Confirmed: The vulnerability has been validated from an analyst's perspective.
- Published Proof of Concept: A public proof of concept is available for this vulnerability.
- Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
- Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
- Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
- Not confirmed: The user expressed doubt about the validity of the vulnerability.
- Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.
Loadingβ¦
Loadingβ¦
The MITRE ATT&CK techniques below are AI-generated suggestions, inferred from the description of the
vulnerability by the CIRCL/vulnerability-attack-technique-classification-roberta-base
model, served locally by ML-Gateway.
They have not been verified by an analyst and are provided for guidance only.
The approach is described in our paper Mapping CVEs to MITRE ATT&CK Techniques: A Curated Gold-Set Classifier and the Limits of LLM-Assisted Label Expansion.
Browse all ATT&CK techniques and the vulnerabilities related to each.
The approach is described in our paper Mapping CVEs to MITRE ATT&CK Techniques: A Curated Gold-Set Classifier and the Limits of LLM-Assisted Label Expansion.
Browse all ATT&CK techniques and the vulnerabilities related to each.
Loadingβ¦
Related by attack behaviour
Vulnerabilities whose description is nearest to this one in the vector space of the CIRCL/vulnerability-attack-technique-biencoder model. This is a similarity search over the bi-encoder space (plain cosine), not a classification, and it has no measured accuracy.
Loadingβ¦