---
id: "CVE-2026-112184"
kind: "vulnerability"
aliases: ["CVE-2026-112184"]
title: "MISP: workflow module page renders service parameter names as raw HTML"
severity: "medium"
cvss: 4.8
epss: null
exploited: false
status: "open"
category: "package"
products: []
ecosystems: []
tags: ["misp", "package", "self-hosted", "threat-intel"]
not_affected_if: ["default-config"]
published_at: "2026-10-19T10:16:47+00:00"
first_seen_at: "2026-10-23T21:57:17+00:00"
updated_at: "2026-10-25T04:33:33+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-112184", "first_seen_at": "2026-10-23T21:57:17+00:00"}]
---

# MISP: workflow module page renders service parameter names as raw HTML

MISP's workflow module page prints parameter names returned by the misp-modules service as unescaped HTML form labels. An attacker who controls those names can run JavaScript in the browser of a logged-in MISP user.

_Summary, check and fix written by a model from the sources; labelled as such._

## How to check

- Check the MISP version with `cat /var/www/MISP/VERSION.json` or the About page; versions below `2.5.48` are affected.
- Check whether misp-modules is reachable by or fed data from untrusted sources.

## Fix

- Upgrade MISP to `2.5.48` or later.
- Until upgraded, restrict access to the workflow module pages to trusted users.

## Timeline

- 2026-10-23T21:57:17+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-112184

## From the sources

MISP contains a reflected cross-site scripting (XSS) vulnerability in the workflow module interface. Parameter names returned by the misp-modules service are rendered as raw HTML form labels on the workflow module page without output encoding. An attacker who can influence the parameter names reported by the misp-modules service can inject arbitrary HTML or JavaScript that executes in the context of an authenticated MISP user's browser.

Preconditions:

- The attacker must be able to control or influence parameter names reported by the misp-modules service.

- A victim must be authenticated and view the affected workflow module page.

Impact:

- Execution of arbitrary JavaScript in the victim's browser session.

- Potential theft of session tokens, manipulation of the MISP interface, or initiation of unauthorized actions on behalf of the victim.

Affected versions: <2.5.48.

---

_Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai_