Live › vulnerability › CVE-2026-112183
Go to dashboardMISP writes the colour of each remote tag into an inline style attribute without proper validation, so a malicious or compromised linked MISP server can inject CSS declarations. When a local user previews a remote event, the injected CSS renders, enabling UI spoofing or limited information disclosure via CSS techniques.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-23 21:57 UTC. All times on this page are UTC.
Teams running MISP that have linked (remote) MISP servers and whose users preview events from those servers. Exposure depends on trusting the linked server, since the attacker must be able to create or modify tags there. Instances with no linked servers, or only trusted ones, have a much smaller exposure.
No product ranges from the sources yet.
misp --version or the installed app version in the admin dashboard; versions below 2.5.48 are affected2.5.48 or laterEach row is the first time that source carried this signal. The analyst’s rows are its own findings.
MISP contains a CSS injection vulnerability in the remote event preview feature. When a user previews an event from a linked MISP server, the colour value associated with each remote tag is written directly into an inline CSS style attribute without sufficient validation. Although HTML entity encoding is applied, the value is interpreted as CSS within the style attribute, allowing a malicious or compromised linked server to inject arbitrary CSS declarations.
An attacker with the ability to create or modify tags on a linked MISP instance can craft a tag colour value containing CSS injection payloads. When a user on the local instance views the event preview, the injected CSS is rendered, potentially allowing UI manipulation, visual spoofing, or limited information disclosure through CSS-based techniques.
Preconditions:
A linked MISP server relationship exists between the victim instance and the attacker-controlled instance.
The attacker can create or modify tags on the linked server.
A victim user views the remote event preview page.
Affected: <2.5.48.
This page as .md · .json · in your agent: get_signal("CVE-2026-112183")
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.