Live › vulnerability › CVE-2026-112184
Go to dashboardMISP's workflow module page prints parameter names returned by the misp-modules service as unescaped HTML form labels. An attacker who controls those names can run JavaScript in the browser of a logged-in MISP user.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-23 21:57 UTC. All times on this page are UTC.
Self-hosted or managed MISP instances below 2.5.48 that use the workflow module with misp-modules. Exposure depends on whether an attacker can influence the parameter names misp-modules reports, which the sources do not detail. Instances without the workflow module or without untrusted module input have a lower risk.
No product ranges from the sources yet.
cat /var/www/MISP/VERSION.json or the About page; versions below 2.5.48 are affected.2.5.48 or later.Each row is the first time that source carried this signal. The analyst’s rows are its own findings.
MISP contains a reflected cross-site scripting (XSS) vulnerability in the workflow module interface. Parameter names returned by the misp-modules service are rendered as raw HTML form labels on the workflow module page without output encoding. An attacker who can influence the parameter names reported by the misp-modules service can inject arbitrary HTML or JavaScript that executes in the context of an authenticated MISP user's browser.
Preconditions:
The attacker must be able to control or influence parameter names reported by the misp-modules service.
A victim must be authenticated and view the affected workflow module page.
Impact:
Execution of arbitrary JavaScript in the victim's browser session.
Potential theft of session tokens, manipulation of the MISP interface, or initiation of unauthorized actions on behalf of the victim.
Affected versions: <2.5.48.
This page as .md · .json · in your agent: get_signal("CVE-2026-112184")
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.