{"id":"CVE-2026-112184","kind":"vulnerability","aliases":["CVE-2026-112184"],"related":[],"title":"MISP: workflow module page renders service parameter names as raw HTML","description":"MISP contains a reflected cross-site scripting (XSS) vulnerability in the workflow module interface. Parameter names returned by the misp-modules service are rendered as raw HTML form labels on the workflow module page without output encoding. An attacker who can influence the parameter names reported by the misp-modules service can inject arbitrary HTML or JavaScript that executes in the context of an authenticated MISP user's browser.\n\nPreconditions:\n\n- The attacker must be able to control or influence parameter names reported by the misp-modules service.\n\n- A victim must be authenticated and view the affected workflow module page.\n\nImpact:\n\n- Execution of arbitrary JavaScript in the victim's browser session.\n\n- Potential theft of session tokens, manipulation of the MISP interface, or initiation of unauthorized actions on behalf of the victim.\n\nAffected versions: <2.5.48.","summary":"MISP's workflow module page prints parameter names returned by the misp-modules service as unescaped HTML form labels. An attacker who controls those names can run JavaScript in the browser of a logged-in MISP user.","severity":"medium","cvss":4.8,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["misp","package","self-hosted","threat-intel"],"not_affected_if":["default-config"],"how_to_check":"- Check the MISP version with `cat /var/www/MISP/VERSION.json` or the About page; versions below `2.5.48` are affected.\n- Check whether misp-modules is reachable by or fed data from untrusted sources.","fix":"- Upgrade MISP to `2.5.48` or later.\n- Until upgraded, restrict access to the workflow module pages to trusted users.","status":"open","published_at":"2026-10-19T10:16:47+00:00","first_seen_at":"2026-10-23T21:57:17+00:00","triaged_at":"2026-10-25T04:33:33+00:00","updated_at":"2026-10-25T04:33:33+00:00","category":"package","confidence":0.7,"triage":{"at":"2026-10-25T04:33:33Z","model":"claude-haiku-5-5","output":{"fix":"- Upgrade MISP to `2.5.48` or later.\n- Until upgraded, restrict access to the workflow module pages to trusted users.","reach":"internet","title":"MISP: workflow module page renders service parameter names as raw HTML","impact":"medium","summary":"MISP's workflow module page prints parameter names returned by the misp-modules service as unescaped HTML form labels. An attacker who controls those names can run JavaScript in the browser of a logged-in MISP user.","category":"package","nicknames":[],"who_cares":["misp","self-hosted","threat-intel"],"confidence":0.7,"needs_auth":"yes","worst_case":"Attacker runs scripts in a logged-in MISP user's browser session","analyst_note":"Confirm the exact fixed version and which misp-modules inputs an attacker can control, using the NVD entry and the MISP release notes.","how_to_check":"- Check the MISP version with `cat /var/www/MISP/VERSION.json` or the About page; versions below `2.5.48` are affected.\n- Check whether misp-modules is reachable by or fed data from untrusted sources.","needs_analyst":true,"not_affected_if":["default-config"],"who_is_affected":"Self-hosted or managed MISP instances below 2.5.48 that use the workflow module with misp-modules. Exposure depends on whether an attacker can influence the parameter names misp-modules reports, which the sources do not detail. Instances without the workflow module or without untrusted module input have a lower risk.","user_interaction":"yes","needs_special_setup":"yes","severity_if_unknown":"medium"},"cost_usd":0.000628,"input_tokens":3498,"output_tokens":557,"severity_before":"medium"},"analyst_status":null,"analyst_note":null,"search":"'-112184':14A,17A '-2026':13A,16A '2.5.48':201C 'abl':142C 'action':193C 'affect':164C,199C 'arbitrari':121C,171C 'attack':47B,105C,139C 'authent':132C,160C 'behalf':195C 'browser':57B,136C,177C 'contain':66C 'context':129C 'control':49B,144C 'cross':70C 'cross-sit':69C 'cve':12A,15A 'encod':103C 'execut':126C,169C 'form':44B,94C 'host':22B 'html':11A,43B,93C,122C 'impact':168C 'influenc':108C,146C 'initi':190C 'inject':120C 'intel':25B 'interfac':79C,188C 'javascript':54B,124C,172C 'label':45B,95C 'log':61B 'logged-in':60B 'manipul':184C 'misp':1A,18B,26B,38B,63B,65C,86C,116C,133C,153C,187C 'misp-modul':37B,85C,115C,152C 'modul':3A,29B,39B,78C,87C,99C,117C,154C,166C 'must':140C,158C 'name':8A,33B,51B,81C,111C,148C 'output':102C 'packag':19B 'page':4A,30B,100C,167C 'paramet':7A,32B,80C,110C,147C 'potenti':179C 'precondit':137C 'print':31B 'raw':10A,92C 'reflect':68C 'render':5A,90C 'report':112C,149C 'return':34B,82C 'run':53B 'script':72C 'self':21B 'self-host':20B 'servic':6A,40B,88C,118C,155C 'session':178C,182C 'site':71C 'theft':180C 'threat':24B 'threat-intel':23B 'token':183C 'unauthor':192C 'unescap':42B 'user':64B,134C 'version':200C 'victim':157C,175C,198C 'view':162C 'vulner':74C 'without':101C 'workflow':2A,28B,77C,98C,165C 'xss':73C","nicknames":[],"mitigations":[],"who_affected":"Self-hosted or managed MISP instances below 2.5.48 that use the workflow module with misp-modules. Exposure depends on whether an attacker can influence the parameter names misp-modules reports, which the sources do not detail. Instances without the workflow module or without untrusted module input have a lower risk.","tier":"C","verified":{},"analyst_revisit_at":null,"first_public_at":"2026-10-19T10:16:47+00:00","kev":null,"cvss_vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:A/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","cvss_by":"5a6e4751-2f3f-4070-9419-94fb35b644e8","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-112184","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-112184","severity":null,"published_at":"2026-10-19T10:16:47+00:00","modified_at":"2026-10-19T18:17:03+00:00","first_seen_at":"2026-10-23T21:57:17+00:00","fetched_at":"2026-10-23T22:28:56+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}