{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-103662", "assignerOrgId": "5a6e4751-2f3f-4070-9419-94fb35b644e8", "state": "PUBLISHED", "assignerShortName": "CIRCL", "dateReserved": "2026-10-01T08:48:36.324Z", "datePublished": "2026-10-01T08:48:38.222Z", "dateUpdated": "2026-10-01T08:48:38.222Z"}, "containers": {"cna": {"affected": [{"cpes": ["cpe:2.3:a:misp:misp:*:*:*:*:*:*:*:*"], "modules": ["Taxonomies (add_tag", "disable_tag views)"], "product": "MISP", "programFiles": ["app/View/Taxonomies/add_tag.ctp", "app/View/Taxonomies/disable_tag.ctp"], "repo": "https://github.com/MISP/MISP", "vendor": "MISP", "versions": [{"lessThan": "2.5.48", "status": "affected", "version": "0", "versionType": "semver"}]}], "credits": [{"lang": "en", "type": "reporter", "value": "C\u00e9lien Desteucq of NCIA"}, {"lang": "en", "type": "remediation developer", "value": "iglocska"}, {"lang": "en", "type": "remediation developer", "value": "Claude Opus 5.5 (1M context)"}], "descriptions": [{"lang": "en", "supportingMedia": [{"base64": false, "type": "text/html", "value": "<p>MISP contains a reflected cross-site scripting (XSS) vulnerability in the legacy taxonomy tag management confirmation forms (add tag and disable tag).</p><p>The affected forms echoed a user-supplied tag name value from the request unescaped into the rendered HTML output. An attacker who can induce a site administrator to visit a crafted URL containing a malicious tag name parameter can execute arbitrary JavaScript in the administrator's browser session.</p><p>Preconditions:</p><p>- The target must be running a MISP instance with the legacy taxonomy tag confirmation views enabled.</p><p>- The victim must be an authenticated site administrator.</p><p>- The victim must navigate to the attacker-crafted URL (e.g., via a phishing link).</p><p>Security impact:</p><p>- Execution of arbitrary client-side script in the context of the administrator's browser.</p><p>- Potential theft of session tokens, CSRF tokens, or other sensitive data accessible from the page.</p><p>- Potential for performing privileged actions on behalf of the administrator within the MISP interface.</p><p>Affected versions: &lt;2.5.48.</p>"}], "value": "MISP contains a reflected cross-site scripting (XSS) vulnerability in the legacy taxonomy tag management confirmation forms (add tag and disable tag).\n\nThe affected forms echoed a user-supplied tag name value from the request unescaped into the rendered HTML output. An attacker who can induce a site administrator to visit a crafted URL containing a malicious tag name parameter can execute arbitrary JavaScript in the administrator's browser session.\n\nPreconditions:\n\n- The target must be running a MISP instance with the legacy taxonomy tag confirmation views enabled.\n\n- The victim must be an authenticated site administrator.\n\n- The victim must navigate to the attacker-crafted URL (e.g., via a phishing link).\n\nSecurity impact:\n\n- Execution of arbitrary client-side script in the context of the administrator's browser.\n\n- Potential theft of session tokens, CSRF tokens, or other sensitive data accessible from the page.\n\n- Potential for performing privileged actions on behalf of the administrator within the MISP interface.\n\nAffected versions: <2.5.48."}], "impacts": [{"capecId": "CAPEC-63", "descriptions": [{"lang": "en", "value": "CAPEC-63 Reflected Cross-Site Scripting"}]}], "metrics": [{"cvssV4_0": {"Automatable": "NOT_DEFINED", "Recovery": "NOT_DEFINED", "Safety": "NOT_DEFINED", "attackComplexity": "LOW", "attackRequirements": "NONE", "attackVector": "NETWORK", "baseScore": 5.1, "baseSeverity": "MEDIUM", "privilegesRequired": "NONE", "providerUrgency": "NOT_DEFINED", "subAvailabilityImpact": "NONE", "subConfidentialityImpact": "NONE", "subIntegrityImpact": "NONE", "userInteraction": "ACTIVE", "valueDensity": "NOT_DEFINED", "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N", "version": "4.0", "vulnAvailabilityImpact": "NONE", "vulnConfidentialityImpact": "LOW", "vulnIntegrityImpact": "LOW", "vulnerabilityResponseEffort": "NOT_DEFINED"}, "format": "CVSS", "scenarios": [{"lang": "en", "value": "GENERAL"}]}, {"format": "SSVC", "other": {"content": {"options": [{"Exploitation": "none"}, {"Automatable": "yes"}, {"Technical Impact": "partial"}], "role": "Supplier", "timestamp": "2026-10-01T08:34:46Z", "version": "2.0.3"}, "type": "SSVC"}, "scenarios": [{"lang": "en", "value": "GENERAL"}]}], "problemTypes": [{"descriptions": [{"cweId": "CWE-79", "description": "CWE-79 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')", "lang": "en", "type": "CWE"}]}], "providerMetadata": {"orgId": "5a6e4751-2f3f-4070-9419-94fb35b644e8", "shortName": "CIRCL", "dateUpdated": "2026-10-01T08:48:38.222Z"}, "references": [{"name": "Security patch", "tags": ["patch"], "url": "https://github.com/MISP/MISP/commit/9619083c8"}], "solutions": [{"lang": "en", "supportingMedia": [{"base64": false, "type": "text/html", "value": "<p>The vulnerability is remediated by HTML-encoding the user-supplied tag name value before it is interpolated into the confirmation form description text. This ensures that any HTML metacharacters in the input are rendered as inert text rather than executable markup, neutralizing the reflected XSS vector.</p>"}], "value": "The vulnerability is remediated by HTML-encoding the user-supplied tag name value before it is interpolated into the confirmation form description text. This ensures that any HTML metacharacters in the input are rendered as inert text rather than executable markup, neutralizing the reflected XSS vector."}], "title": "MISP Reflected XSS in Taxonomy Tag Confirmation Forms", "x_gcve": [{"extensions": {"bcp-05-x-01": {"ai_annotations": [{"ai_level": "generated", "description": "Draft vulnerability metadata was generated from a git-format patch using an Ollama-hosted language model. Human validation is required before publication.", "gna_source": 1, "models": [{"gna_source": 1, "identifier": "qwen3.8:27b", "name": "qwen3.8:27b", "source": "ollama"}], "review_status": "full", "scope": "record", "tags": ["ai-computer-assisted:llm-generated", "ai-computer-assisted:classification"]}]}, "bcp-05-x-02": {"x_patch2vuln": {"assumptions": ["The tag v2.5.48 is assumed to be the first release containing the fix based on the tag_version_boundary metadata showing 44 commits after the fix commit; the exact release version that first shipped the fix is not explicitly stated.", "The vulnerability requires the legacy taxonomy tag confirmation views to be in use; if MISP has migrated to a different UI for taxonomy management, the attack surface may not be reachable.", "PR:N is assumed because the attacker does not need their own MISP account; they only need to deliver a crafted URL to an authenticated admin. If the form is only reachable via authenticated session and the parameter cannot be injected via URL for unauthenticated users, PR could be elevated.", "The Co-Authored-By line references an AI tool (Claude Opus 5.5); this is not credited as a human contributor per standard CVE credit practices.", "CAPEC-63 is selected as the closest match; the exact CAPEC taxonomy does not have a more specific entry for reflected XSS in server-rendered template engines."], "capecRationale": [{"capecId": "CAPEC-63", "rationale": "The commit message explicitly states the tag name is 'echoed from the URL unescaped, a reflected XSS.' The attacker supplies a malicious value via a URL parameter, the application reflects it into the HTML response without encoding, and the script executes in the victim's browser. This is a textbook reflected XSS pattern matching CAPEC-63 exactly."}], "commit": "9619083c8cea496fd3ddbad5bf9be57c91fd2118", "confidence": "high", "credits": [{"lang": "en", "type": "reporter", "value": "C\u00e9lien Desteucq of NCIA"}, {"lang": "en", "type": "remediation developer", "value": "iglocska"}, {"lang": "en", "type": "remediation developer", "value": "Claude Opus 5.5 (1M context)"}], "cvssRationale": "AV:N - the vulnerability is exploitable over the network via a crafted URL. AC:L - no race conditions or special conditions; simply visiting a crafted URL triggers the XSS. AT:N - no attack target manipulation required. PR:N - the attacker does not need authentication; they craft a URL for the admin to visit. UI:A - the administrator must actively navigate to the malicious URL. VC:L - the XSS can read session cookies and page data in the admin's browser. VI:L - the XSS can perform actions on behalf of the admin within the MISP interface. VA:N - no availability impact. SC/SI/SA:N - the impact is confined to the victim's browser session; no secondary system impact is evidenced.", "fixSummary": "The vulnerability is remediated by HTML-encoding the user-supplied tag name value before it is interpolated into the confirmation form description text. This ensures that any HTML metacharacters in the input are rendered as inert text rather than executable markup, neutralizing the reflected XSS vector.", "generatedAt": "2026-10-01T08:34:46.777011Z", "generator": "patch2vuln.py", "model": "qwen3.8:27b", "modelComparison": {"rankings": [{"agreementScore": 11, "assumptionCount": 5, "confidence": "high", "model": "qwen3.8:27b", "score": 8}], "selectedModel": "qwen3.8:27b", "selectionMethod": "deterministic-consensus-v1", "selectionNotice": "The selected result is closest to model consensus; this heuristic does not establish factual correctness and human review remains required."}, "patchSha256": "0255a5f82ee8c34e3f27c236a85f0dfc4379393d7e75c42d4d33fbc6d6b151ac", "patchSummary": "Two view template files (app/View/Taxonomies/add_tag.ctp and app/View/Taxonomies/disable_tag.ctp) are modified. In each file, the raw request data value $this->request->data['Taxonomy']['name'] is wrapped with CakePHP's h() HTML-encoding helper function before being passed to the translation string that renders the confirmation description. This is a one-line change per file, adding the h() wrapper around the previously unescaped variable.", "patchTruncated": false, "patches": [{"commit": "9619083c8cea496fd3ddbad5bf9be57c91fd2118", "date": "Wed, 23 Sep 2026 11:17:07 +0200", "patchSha256": "0255a5f82ee8c34e3f27c236a85f0dfc4379393d7e75c42d4d33fbc6d6b151ac", "source": "https://github.com/MISP/MISP/commit/9619083c8.patch", "sourceUrl": "https://github.com/MISP/MISP/commit/9619083c8.patch", "subject": "fix: [security] Escape the tag name on the taxonomy tag"}], "source": "https://github.com/MISP/MISP/commit/9619083c8.patch", "ssvc": {"options": [{"Exploitation": "none"}, {"Automatable": "yes"}, {"Technical Impact": "partial"}], "role": "Supplier", "timestamp": "2026-10-01T08:34:46Z", "version": "2.0.3"}, "subject": "fix: [security] Escape the tag name on the taxonomy tag", "tagVersionBoundary": {"commits_after_fix": 44, "repository": "https://github.com/MISP/MISP", "tag": "v2.5.48", "version": "2.5.48", "version_type": "semver"}, "weaknessRationale": [{"cweId": "CWE-79", "rationale": "The patch directly addresses a reflected XSS: user-controlled input from the request is echoed into HTML output without encoding. The fix applies HTML entity encoding (h() helper), which is the canonical remediation for CWE-79."}]}}, "bcp-05-x-03": {"x_timeline": {"events": [{"description": "Corrective change authored (9619083c8cea496fd3ddbad5bf9be57c91fd2118): fix: [security] Escape the tag name on the taxonomy tag", "id": "evt-fix-developed-1", "references": ["https://github.com/MISP/MISP/commit/9619083c8.patch"], "timestamp": "2026-09-23T09:17:07Z", "type": "fix-developed"}]}}}, "recordType": "advisory", "vulnId": "GCVE-1-2026-20300"}]}}}

{}

{"affected": [{"affectedData": [{"cpes": ["cpe:2.3:a:misp:misp:*:*:*:*:*:*:*:*"], "modules": ["Taxonomies (add_tag", "disable_tag views)"], "product": "MISP", "programFiles": ["app/View/Taxonomies/add_tag.ctp", "app/View/Taxonomies/disable_tag.ctp"], "repo": "https://github.com/MISP/MISP", "vendor": "MISP", "versions": [{"lessThan": "2.5.48", "status": "affected", "version": "0", "versionType": "semver"}]}], "source": "5a6e4751-2f3f-4070-9419-94fb35b644e8"}], "cveTags": [], "descriptions": [{"lang": "en", "value": "MISP contains a reflected cross-site scripting (XSS) vulnerability in the legacy taxonomy tag management confirmation forms (add tag and disable tag).\n\nThe affected forms echoed a user-supplied tag name value from the request unescaped into the rendered HTML output. An attacker who can induce a site administrator to visit a crafted URL containing a malicious tag name parameter can execute arbitrary JavaScript in the administrator's browser session.\n\nPreconditions:\n\n- The target must be running a MISP instance with the legacy taxonomy tag confirmation views enabled.\n\n- The victim must be an authenticated site administrator.\n\n- The victim must navigate to the attacker-crafted URL (e.g., via a phishing link).\n\nSecurity impact:\n\n- Execution of arbitrary client-side script in the context of the administrator's browser.\n\n- Potential theft of session tokens, CSRF tokens, or other sensitive data accessible from the page.\n\n- Potential for performing privileged actions on behalf of the administrator within the MISP interface.\n\nAffected versions: <2.5.48."}], "id": "CVE-2026-103662", "lastModified": "2026-10-01T09:17:08.597", "metrics": {"cvssMetricV40": [{"cvssData": {"Automatable": "NOT_DEFINED", "Recovery": "NOT_DEFINED", "Safety": "NOT_DEFINED", "attackComplexity": "LOW", "attackRequirements": "NONE", "attackVector": "NETWORK", "availabilityRequirement": "NOT_DEFINED", "baseScore": 5.1, "baseSeverity": "MEDIUM", "confidentialityRequirement": "NOT_DEFINED", "exploitMaturity": "NOT_DEFINED", "integrityRequirement": "NOT_DEFINED", "modifiedAttackComplexity": "NOT_DEFINED", "modifiedAttackRequirements": "NOT_DEFINED", "modifiedAttackVector": "NOT_DEFINED", "modifiedPrivilegesRequired": "NOT_DEFINED", "modifiedSubAvailabilityImpact": "NOT_DEFINED", "modifiedSubConfidentialityImpact": "NOT_DEFINED", "modifiedSubIntegrityImpact": "NOT_DEFINED", "modifiedUserInteraction": "NOT_DEFINED", "modifiedVulnAvailabilityImpact": "NOT_DEFINED", "modifiedVulnConfidentialityImpact": "NOT_DEFINED", "modifiedVulnIntegrityImpact": "NOT_DEFINED", "privilegesRequired": "NONE", "providerUrgency": "NOT_DEFINED", "subAvailabilityImpact": "NONE", "subConfidentialityImpact": "NONE", "subIntegrityImpact": "NONE", "userInteraction": "ACTIVE", "valueDensity": "NOT_DEFINED", "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X", "version": "4.0", "vulnAvailabilityImpact": "NONE", "vulnConfidentialityImpact": "LOW", "vulnIntegrityImpact": "LOW", "vulnerabilityResponseEffort": "NOT_DEFINED"}, "source": "5a6e4751-2f3f-4070-9419-94fb35b644e8", "type": "Secondary"}], "ssvcV203": [{"source": "5a6e4751-2f3f-4070-9419-94fb35b644e8", "ssvcData": {"options": [{"exploitation": "none"}, {"automatable": "yes"}, {"technicalImpact": "partial"}], "role": "Supplier", "timestamp": "2026-10-01T08:34:46Z", "version": "2.0.3"}}]}, "published": "2026-10-01T09:17:08.487", "references": [{"source": "5a6e4751-2f3f-4070-9419-94fb35b644e8", "url": "https://github.com/MISP/MISP/commit/9619083c8"}], "sourceIdentifier": "5a6e4751-2f3f-4070-9419-94fb35b644e8", "vulnStatus": "Deferred", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-79"}], "source": "5a6e4751-2f3f-4070-9419-94fb35b644e8", "type": "Secondary"}]}

{}

{"affected": [{"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "[0,2.5.48)"}}], "enrichment": {"confidence": 99.0, "confidence_source": "inferred", "scores": [{"score": 99.0, "source": "inferred"}, {"score": 100.0, "source": "matching"}]}, "original": {"product": "MISP", "source": "cna", "vendor": "MISP"}, "product": "misp", "vendor": "misp"}], "created": "2026-10-01T11:00:05.720394+00:00", "updated": "2026-10-01T11:15:05.767087+00:00", "vendors": ["misp", "misp$PRODUCT$misp"]}