GCVE-1-2026-20161 (CVE-2026-95661)

Vulnerability from gna-1 – Published: 2026-09-22 12:54 – Updated: 2026-09-22 12:54
VLAI
Title
MISP Reflected Cross-Site Scripting in Attribute Histogram via Unescaped URL-Supplied Type List
Summary
MISP contains a reflected cross-site scripting (XSS) vulnerability in the attribute histogram view. The $selectedTypes variable, which is derived from the URL path segment , was interpolated directly into a JavaScript array literal inside an onClick HTML attribute without any encoding or escaping. An attacker who can cause an authenticated MISP user to visit a crafted URL containing a malicious type value can execute arbitrary JavaScript in the victim's browser within the MISP application origin. Successful exploitation allows the attacker to read session cookies, perform actions on behalf of the victim, or exfiltrate sensitive data accessible from the MISP interface.  The vulnerability requires the victim to be authenticated and to actively navigate to the attacker-supplied URL.
Severity
5.1 (Medium)
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:L/VI:L/VA:N/SC:L/SI:L/SA:N
CWE
  • CWE-79 - Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
Assigner
GNA-1 This instance
References
Impacted products
Vendor Product Version CPE status
MISP MISP Affected: 0 , < 2.5.47 (semver)
guessed Create a notification for this product.
Credits
Jeroen Pinoy iglocska Claude Opus 4.8
GCVE extensions
AI involvement GCVE-BCP-05-X-01
Whole record AI-generated Human-reviewed GNA-1

Draft vulnerability metadata was generated from a git-format patch using an Ollama-hosted language model. Human validation is required before publication.

ai-computer-assisted:llm-generatedai-computer-assisted:classification
Model Source Identifier
qwen3.8:27b ollama qwen3.8:27b
Patch provenance GCVE-BCP-05-X-02
Generator
patch2vuln.py on 2026-09-22 12:45
Model
qwen3.8:27b
Input
https://github.com/MISP/MISP/commit/95b8f21f6.patch 33d145872395…
Confidence
high
Commit Subject Patch SHA-256
95b8f21f6be9 fix: [security] Escape the selected types in the attribute 33d145872395…
Fix summary

The fix replaces the unsafe raw PHP loop that concatenated type values into a JavaScript array literal with a call to json_encode() using the JSON_HEX_TAG, JSON_HEX_APOS, JSON_HEX_QUOT, and JSON_HEX_AMP flags. This ensures that all special characters (angle brackets, quotes, ampersands) in the type values are hex-encoded, preventing any value from breaking out of the JavaScript string/array context and injecting arbitrary script.

Patch summary

In app/View/Elements/histogram.ctp, the onClick attribute previously built a JS array by iterating over $selectedTypes and echoing each value between double quotes with no escaping: [<?php foreach ($selectedTypes as $t) echo '"' . $t . '", ' ?>]. The patch replaces this with a single json_encode($selectedTypes, JSON_HEX_TAG | JSON_HEX_APOS | JSON_HEX_QUOT | JSON_HEX_AMP) call, producing a safely encoded JSON array literal that cannot be broken out of by any element value.

CVSS rationale

AV:N: The vulnerability is exploitable over the network via a crafted URL. AC:L: No race conditions or special environment conditions are required; the attacker simply crafts a URL with a malicious type value. AT:N: No manipulation of the attack target is needed. PR:N: The attacker requires no privileges on the MISP instance; the victim must be authenticated, but that is a precondition on the victim, not a privilege requirement on the attacker. UI:A: The victim must actively click a link or navigate to the attacker-supplied URL for the reflected payload to execute. VC:N, VI:N, VA:N: The MISP server itself is not directly compromised; the impact is confined to the victim's browser session. SC:L: The attacker can read session tokens or data visible in the MISP UI within the victim's browser. SI:L: The attacker can perform actions on behalf of the victim within the MISP application. SA:N: No availability impact on the victim's browser or the MISP server.

Weakness rationale
  • CWE-79 The patch directly addresses the reflection of untrusted, URL-supplied data into a JavaScript context within an HTML attribute without encoding. This is a textbook reflected XSS (CWE-79). The specific sub-type is reflected XSS in a JavaScript context (inline event handler), but CWE-79 is the standard and most precise mapping.
Attack pattern rationale
  • CAPEC-1 CAPEC-1 is the canonical CAPEC pattern for cross-site scripting attacks, covering reflected, stored, and DOM-based variants. The patch evidence shows a reflected XSS where URL-supplied data is injected into an inline JavaScript event handler. CAPEC-1 is the closest and most direct match. No more specific CAPEC sub-pattern for reflected XSS in inline JS handlers exists in the CAPEC catalog, so CAPEC-1 is the best available mapping.
Assumptions to verify
  • The affected version boundary is inferred from the tag_version_boundary metadata (v2.5.47 with 46 commits after the fix); the exact first affected version is not stated in the patch and is assumed to be all versions prior to the fix commit.
  • The UI:A (Active) rating assumes the victim must click a link or manually navigate to the crafted URL; if the URL could be triggered via an auto-redirect or embedded iframe, UI:P (Passive) might be more appropriate.
  • SC:L and SI:L are conservative ratings for the secondary-system impact; a full session hijack or data exfiltration could justify SC:H/SI:H, but the patch evidence does not specify the exact scope of exploitable data.
  • The CAPEC-1 mapping is the closest available pattern; no CAPEC sub-pattern specifically covers reflected XSS in inline JavaScript event handlers, so the general XSS pattern is used.
  • The commit message references 'any logged-in victim,' implying authentication is required; the exact role or permission level of the victim is not specified.
Model comparison

Selected qwen3.8:27b by deterministic-consensus-v1
The selected result is closest to model consensus; this heuristic does not establish factual correctness and human review remains required.

Model Score Agreement Confidence Assumptions
qwen3.8:27b 6 9 high 5
To clipboard 

{
  "containers": {
    "cna": {
      "affected": [
        {
          "modules": [
            "app/View/Elements/histogram.ctp"
          ],
          "product": "MISP",
          "programFiles": [
            "app/View/Elements/histogram.ctp"
          ],
          "repo": "https://github.com/MISP/MISP",
          "vendor": "MISP",
          "versions": [
            {
              "lessThan": "2.5.47",
              "status": "affected",
              "version": "0",
              "versionType": "semver"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "reporter",
          "value": "Jeroen Pinoy"
        },
        {
          "lang": "en",
          "type": "remediation developer",
          "value": "iglocska"
        },
        {
          "lang": "en",
          "type": "remediation developer",
          "value": "Claude Opus 4.8"
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "supportingMedia": [
            {
              "base64": false,
              "type": "text/html",
              "value": "\u003cp\u003eMISP contains a reflected cross-site scripting (XSS) vulnerability in the attribute histogram view. The $selectedTypes variable, which is derived from the URL path segment , was interpolated directly into a JavaScript array literal inside an onClick HTML attribute without any encoding or escaping. An attacker who can cause an authenticated MISP user to visit a crafted URL containing a malicious type value can execute arbitrary JavaScript in the victim\u0027s browser within the MISP application origin.\u003c/p\u003e\u003cp\u003eSuccessful exploitation allows the attacker to read session cookies, perform actions on behalf of the victim, or exfiltrate sensitive data accessible from the MISP interface.\u0026nbsp;\u003c/p\u003e\u003cp\u003eThe vulnerability requires the victim to be authenticated and to actively navigate to the attacker-supplied URL.\u003c/p\u003e"
            }
          ],
          "value": "MISP contains a reflected cross-site scripting (XSS) vulnerability in the attribute histogram view. The $selectedTypes variable, which is derived from the URL path segment , was interpolated directly into a JavaScript array literal inside an onClick HTML attribute without any encoding or escaping. An attacker who can cause an authenticated MISP user to visit a crafted URL containing a malicious type value can execute arbitrary JavaScript in the victim\u0027s browser within the MISP application origin.\n\nSuccessful exploitation allows the attacker to read session cookies, perform actions on behalf of the victim, or exfiltrate sensitive data accessible from the MISP interface.\u00a0\n\nThe vulnerability requires the victim to be authenticated and to actively navigate to the attacker-supplied URL."
        }
      ],
      "impacts": [
        {
          "capecId": "CAPEC-1",
          "descriptions": [
            {
              "lang": "en",
              "value": "CAPEC-1 Cross Site Scripting (XSS)"
            }
          ]
        }
      ],
      "metrics": [
        {
          "cvssV4_0": {
            "Automatable": "NOT_DEFINED",
            "Recovery": "NOT_DEFINED",
            "Safety": "NOT_DEFINED",
            "attackComplexity": "LOW",
            "attackRequirements": "NONE",
            "attackVector": "NETWORK",
            "baseScore": 5.1,
            "baseSeverity": "MEDIUM",
            "privilegesRequired": "NONE",
            "providerUrgency": "NOT_DEFINED",
            "subAvailabilityImpact": "NONE",
            "subConfidentialityImpact": "LOW",
            "subIntegrityImpact": "LOW",
            "userInteraction": "ACTIVE",
            "valueDensity": "NOT_DEFINED",
            "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:L/VI:L/VA:N/SC:L/SI:L/SA:N",
            "version": "4.0",
            "vulnAvailabilityImpact": "NONE",
            "vulnConfidentialityImpact": "LOW",
            "vulnIntegrityImpact": "LOW",
            "vulnerabilityResponseEffort": "NOT_DEFINED"
          },
          "format": "CVSS",
          "scenarios": [
            {
              "lang": "en",
              "value": "GENERAL"
            }
          ]
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-79",
              "description": "CWE-79 Improper Neutralization of Input During Web Page Generation (\u0027Cross-site Scripting\u0027)",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "orgId": "00000000-0000-4000-9000-000000000000"
      },
      "references": [
        {
          "name": "Security patch",
          "tags": [
            "patch"
          ],
          "url": "https://github.com/MISP/MISP/commit/95b8f21f6"
        }
      ],
      "solutions": [
        {
          "lang": "en",
          "supportingMedia": [
            {
              "base64": false,
              "type": "text/html",
              "value": "\u003cp\u003eThe fix replaces the unsafe raw PHP loop that concatenated type values into a JavaScript array literal with a call to json_encode() using the JSON_HEX_TAG, JSON_HEX_APOS, JSON_HEX_QUOT, and JSON_HEX_AMP flags. This ensures that all special characters (angle brackets, quotes, ampersands) in the type values are hex-encoded, preventing any value from breaking out of the JavaScript string/array context and injecting arbitrary script.\u003c/p\u003e"
            }
          ],
          "value": "The fix replaces the unsafe raw PHP loop that concatenated type values into a JavaScript array literal with a call to json_encode() using the JSON_HEX_TAG, JSON_HEX_APOS, JSON_HEX_QUOT, and JSON_HEX_AMP flags. This ensures that all special characters (angle brackets, quotes, ampersands) in the type values are hex-encoded, preventing any value from breaking out of the JavaScript string/array context and injecting arbitrary script."
        }
      ],
      "title": "MISP Reflected Cross-Site Scripting in Attribute Histogram via Unescaped URL-Supplied Type List",
      "x_gcve": [
        {
          "extensions": {
            "bcp-05-x-01": {
              "ai_annotations": [
                {
                  "ai_level": "generated",
                  "description": "Draft vulnerability metadata was generated from a git-format patch using an Ollama-hosted language model. Human validation is required before publication.",
                  "gna_source": 1,
                  "models": [
                    {
                      "gna_source": 1,
                      "identifier": "qwen3.8:27b",
                      "name": "qwen3.8:27b",
                      "source": "ollama"
                    }
                  ],
                  "review_status": "full",
                  "scope": "record",
                  "tags": [
                    "ai-computer-assisted:llm-generated",
                    "ai-computer-assisted:classification"
                  ]
                }
              ]
            },
            "bcp-05-x-02": {
              "x_patch2vuln": {
                "assumptions": [
                  "The affected version boundary is inferred from the tag_version_boundary metadata (v2.5.47 with 46 commits after the fix); the exact first affected version is not stated in the patch and is assumed to be all versions prior to the fix commit.",
                  "The UI:A (Active) rating assumes the victim must click a link or manually navigate to the crafted URL; if the URL could be triggered via an auto-redirect or embedded iframe, UI:P (Passive) might be more appropriate.",
                  "SC:L and SI:L are conservative ratings for the secondary-system impact; a full session hijack or data exfiltration could justify SC:H/SI:H, but the patch evidence does not specify the exact scope of exploitable data.",
                  "The CAPEC-1 mapping is the closest available pattern; no CAPEC sub-pattern specifically covers reflected XSS in inline JavaScript event handlers, so the general XSS pattern is used.",
                  "The commit message references \u0027any logged-in victim,\u0027 implying authentication is required; the exact role or permission level of the victim is not specified."
                ],
                "capecRationale": [
                  {
                    "capecId": "CAPEC-1",
                    "rationale": "CAPEC-1 is the canonical CAPEC pattern for cross-site scripting attacks, covering reflected, stored, and DOM-based variants. The patch evidence shows a reflected XSS where URL-supplied data is injected into an inline JavaScript event handler. CAPEC-1 is the closest and most direct match. No more specific CAPEC sub-pattern for reflected XSS in inline JS handlers exists in the CAPEC catalog, so CAPEC-1 is the best available mapping."
                  }
                ],
                "commit": "95b8f21f6be9e20323dd101e7d085fc34765c7b7",
                "confidence": "high",
                "credits": [
                  {
                    "lang": "en",
                    "type": "reporter",
                    "value": "Jeroen Pinoy"
                  },
                  {
                    "lang": "en",
                    "type": "remediation developer",
                    "value": "iglocska"
                  },
                  {
                    "lang": "en",
                    "type": "remediation developer",
                    "value": "Claude Opus 4.8"
                  }
                ],
                "cvssRationale": "AV:N: The vulnerability is exploitable over the network via a crafted URL. AC:L: No race conditions or special environment conditions are required; the attacker simply crafts a URL with a malicious type value. AT:N: No manipulation of the attack target is needed. PR:N: The attacker requires no privileges on the MISP instance; the victim must be authenticated, but that is a precondition on the victim, not a privilege requirement on the attacker. UI:A: The victim must actively click a link or navigate to the attacker-supplied URL for the reflected payload to execute. VC:N, VI:N, VA:N: The MISP server itself is not directly compromised; the impact is confined to the victim\u0027s browser session. SC:L: The attacker can read session tokens or data visible in the MISP UI within the victim\u0027s browser. SI:L: The attacker can perform actions on behalf of the victim within the MISP application. SA:N: No availability impact on the victim\u0027s browser or the MISP server.",
                "fixSummary": "The fix replaces the unsafe raw PHP loop that concatenated type values into a JavaScript array literal with a call to json_encode() using the JSON_HEX_TAG, JSON_HEX_APOS, JSON_HEX_QUOT, and JSON_HEX_AMP flags. This ensures that all special characters (angle brackets, quotes, ampersands) in the type values are hex-encoded, preventing any value from breaking out of the JavaScript string/array context and injecting arbitrary script.",
                "generatedAt": "2026-09-22T12:45:39.951248Z",
                "generator": "patch2vuln.py",
                "model": "qwen3.8:27b",
                "modelComparison": {
                  "rankings": [
                    {
                      "agreementScore": 9,
                      "assumptionCount": 5,
                      "confidence": "high",
                      "model": "qwen3.8:27b",
                      "score": 6
                    }
                  ],
                  "selectedModel": "qwen3.8:27b",
                  "selectionMethod": "deterministic-consensus-v1",
                  "selectionNotice": "The selected result is closest to model consensus; this heuristic does not establish factual correctness and human review remains required."
                },
                "patchSha256": "33d14587239572ed6af4ca5d122f4b92405dbce1ff0317a1ff1e6e026073dc8c",
                "patchSummary": "In app/View/Elements/histogram.ctp, the onClick attribute previously built a JS array by iterating over $selectedTypes and echoing each value between double quotes with no escaping: [\u003c?php foreach ($selectedTypes as $t) echo \u0027\"\u0027 . $t . \u0027\", \u0027 ?\u003e]. The patch replaces this with a single json_encode($selectedTypes, JSON_HEX_TAG | JSON_HEX_APOS | JSON_HEX_QUOT | JSON_HEX_AMP) call, producing a safely encoded JSON array literal that cannot be broken out of by any element value.",
                "patchTruncated": false,
                "patches": [
                  {
                    "commit": "95b8f21f6be9e20323dd101e7d085fc34765c7b7",
                    "patchSha256": "33d14587239572ed6af4ca5d122f4b92405dbce1ff0317a1ff1e6e026073dc8c",
                    "source": "https://github.com/MISP/MISP/commit/95b8f21f6.patch",
                    "sourceUrl": "https://github.com/MISP/MISP/commit/95b8f21f6.patch",
                    "subject": "fix: [security] Escape the selected types in the attribute"
                  }
                ],
                "source": "https://github.com/MISP/MISP/commit/95b8f21f6.patch",
                "subject": "fix: [security] Escape the selected types in the attribute",
                "tagVersionBoundary": {
                  "commits_after_fix": 46,
                  "repository": "https://github.com/MISP/MISP",
                  "tag": "v2.5.47",
                  "version": "2.5.47",
                  "version_type": "semver"
                },
                "weaknessRationale": [
                  {
                    "cweId": "CWE-79",
                    "rationale": "The patch directly addresses the reflection of untrusted, URL-supplied data into a JavaScript context within an HTML attribute without encoding. This is a textbook reflected XSS (CWE-79). The specific sub-type is reflected XSS in a JavaScript context (inline event handler), but CWE-79 is the standard and most precise mapping."
                  }
                ]
              }
            }
          },
          "recordType": "advisory",
          "vulnId": "GCVE-1-2026-20161"
        }
      ]
    }
  },
  "cveMetadata": {
    "assignerOrgId": "00000000-0000-4000-9000-000000000000",
    "cveId": "CVE-2026-95661",
    "datePublished": "2026-09-22T12:54:36.084083Z",
    "dateReserved": "2026-09-22T12:54:43.824Z",
    "dateUpdated": "2026-09-22T12:54:44.014502Z",
    "state": "PUBLISHED",
    "vulnId": "GCVE-1-2026-20161"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1"
}



Log in or create an account to share your comment.




Tags
Taxonomy of the tags.





Forecast uses a logistic model when the trend is rising, or an exponential decay model when the trend is falling. Fitted via linearized least squares.

Sightings

Author Source Type Date Other

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or observed by the user.
  • Confirmed: The vulnerability has been validated from an analyst's perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
  • Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
  • Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
  • Not confirmed: The user expressed doubt about the validity of the vulnerability.
  • Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.



Related by attack behaviour

Vulnerabilities whose description is nearest to this one in the vector space of the CIRCL/vulnerability-attack-technique-biencoder model. This is a similarity search over the bi-encoder space (plain cosine), not a classification, and it has no measured accuracy.