{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-94372", "assignerOrgId": "5a6e4751-2f3f-4070-9419-94fb35b644e8", "state": "PUBLISHED", "assignerShortName": "CIRCL", "dateReserved": "2026-09-21T12:02:13.614Z", "datePublished": "2026-09-21T12:02:17.104Z", "dateUpdated": "2026-09-21T12:02:17.104Z"}, "containers": {"cna": {"affected": [{"modules": ["Galaxies index (default theme)"], "product": "MISP", "programFiles": ["app/View/Galaxies/index.ctp"], "repo": "https://github.com/MISP/MISP", "vendor": "MISP", "versions": [{"lessThan": "2.5.47", "status": "affected", "version": "0", "versionType": "semver"}]}], "credits": [{"lang": "en", "type": "reporter", "value": "Jeroen Pinoy"}, {"lang": "en", "type": "remediation developer", "value": "iglocska"}, {"lang": "en", "type": "remediation developer", "value": "Claude Opus 4.8"}], "descriptions": [{"lang": "en", "supportingMedia": [{"base64": false, "type": "text/html", "value": "<p>MISP contains a stored cross-site scripting (XSS) vulnerability in the default theme's Galaxies index page. When a MISP instance detects unknown custom or default galaxy clusters during synchronization, it renders sample tag names in an informational notice directed at site administrators. In the default theme, these sample tag names were inserted into the HTML output without HTML-entity encoding. A user with tag-editor privileges could craft a malicious misp-galaxy tag containing arbitrary script. When a site administrator subsequently viewed the Galaxies index page, the crafted tag content was interpreted as executable markup in the administrator's browser session, enabling the attacker to read session data, perform actions on behalf of the administrator, or otherwise compromise the administrator's browser context. The Overmind theme already applied HTML escaping to the same values and was not affected. The vulnerability requires the attacker to possess tag-editor-level access to create the crafted tag and requires the victim (a site administrator) to view the Galaxies index page in the default theme. The impact is limited to the administrator's browser session and does not directly compromise the MISP server process.</p><p>Version affected: &lt;2.5.47</p>"}], "value": "MISP contains a stored cross-site scripting (XSS) vulnerability in the default theme's Galaxies index page. When a MISP instance detects unknown custom or default galaxy clusters during synchronization, it renders sample tag names in an informational notice directed at site administrators. In the default theme, these sample tag names were inserted into the HTML output without HTML-entity encoding. A user with tag-editor privileges could craft a malicious misp-galaxy tag containing arbitrary script. When a site administrator subsequently viewed the Galaxies index page, the crafted tag content was interpreted as executable markup in the administrator's browser session, enabling the attacker to read session data, perform actions on behalf of the administrator, or otherwise compromise the administrator's browser context. The Overmind theme already applied HTML escaping to the same values and was not affected. The vulnerability requires the attacker to possess tag-editor-level access to create the crafted tag and requires the victim (a site administrator) to view the Galaxies index page in the default theme. The impact is limited to the administrator's browser session and does not directly compromise the MISP server process.\n\nVersion affected: <2.5.47"}], "impacts": [{"capecId": "CAPEC-1", "descriptions": [{"lang": "en", "value": "CAPEC-1 Improper Neutralization of Input"}]}], "metrics": [{"cvssV4_0": {"Automatable": "NOT_DEFINED", "Recovery": "NOT_DEFINED", "Safety": "NOT_DEFINED", "attackComplexity": "LOW", "attackRequirements": "NONE", "attackVector": "NETWORK", "baseScore": 6.3, "baseSeverity": "MEDIUM", "privilegesRequired": "LOW", "providerUrgency": "NOT_DEFINED", "subAvailabilityImpact": "NONE", "subConfidentialityImpact": "HIGH", "subIntegrityImpact": "HIGH", "userInteraction": "PASSIVE", "valueDensity": "NOT_DEFINED", "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:P/VC:N/VI:N/VA:N/SC:H/SI:H/SA:N", "version": "4.0", "vulnAvailabilityImpact": "NONE", "vulnConfidentialityImpact": "NONE", "vulnIntegrityImpact": "NONE", "vulnerabilityResponseEffort": "NOT_DEFINED"}, "format": "CVSS", "scenarios": [{"lang": "en", "value": "GENERAL"}]}], "problemTypes": [{"descriptions": [{"cweId": "CWE-79", "description": "CWE-79 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')", "lang": "en", "type": "CWE"}]}], "providerMetadata": {"orgId": "5a6e4751-2f3f-4070-9419-94fb35b644e8", "shortName": "CIRCL", "dateUpdated": "2026-09-21T12:02:17.104Z"}, "references": [{"name": "Security patch", "tags": ["patch"], "url": "https://github.com/MISP/MISP/commit/ce10436ae"}], "solutions": [{"lang": "en", "supportingMedia": [{"base64": false, "type": "text/html", "value": "<p>The fix applies CakePHP's h() HTML-encoding function to each sample tag name before it is interpolated into the HTML notice. This ensures that any angle brackets, quotes, or ampersands contained in user-supplied tag names are rendered as inert HTML entities, preventing script execution in the administrator's browser.</p>"}], "value": "The fix applies CakePHP's h() HTML-encoding function to each sample tag name before it is interpolated into the HTML notice. This ensures that any angle brackets, quotes, or ampersands contained in user-supplied tag names are rendered as inert HTML entities, preventing script execution in the administrator's browser."}], "title": "Stored Cross-Site Scripting via Unescaped Galaxy Cluster Tag Names in MISP Default Theme Galaxies Index", "x_gcve": [{"extensions": {"bcp-05-x-01": {"ai_annotations": [{"ai_level": "generated", "description": "Draft vulnerability metadata was generated from a git-format patch using an Ollama-hosted language model. Human validation is required before publication.", "gna_source": 1, "models": [{"gna_source": 1, "identifier": "qwen3.8:27b", "name": "qwen3.8:27b", "source": "ollama"}], "review_status": "review", "scope": "record", "tags": ["ai-computer-assisted:llm-generated", "ai-computer-assisted:classification"]}]}, "bcp-05-x-02": {"x_patch2vuln": {"assumptions": ["The tag_version_boundary (v2.5.47, 45 commits after fix) is interpreted as the fix landing after v2.5.47; exact affected version range is not explicitly stated in the patch and is marked as less_than 2.5.47 with status affected, but this is an inference.", "The 'tag editor' role is assumed to be a lower-privilege role than site admin in MISP's RBAC model, justifying PR:L.", "UI:P (Passive) is used because the victim only needs to load the Galaxies index page; no click or explicit interaction with the malicious content is required. The previous UI:R value was invalid in CVSS v4.0 (valid values: N, P, A).", "CAPEC-1 is the closest available pattern; no CAPEC specifically names stored XSS, so the mapping is approximate.", "The Overmind theme is stated in the commit message as already escaping these values; it is assumed unaffected but no patch evidence for it is provided.", "The Co-Authored-By line for Claude Opus 4.8 is treated as a remediation developer credit per the supplied metadata; it is unclear whether this represents an AI-assisted contribution or a human developer using AI tooling."], "capecRationale": [{"capecId": "CAPEC-1", "rationale": "CAPEC-1 is the closest available pattern describing an attacker supplying malicious input that is not properly neutralized before being used in a context where it is interpreted (here, HTML). No dedicated CAPEC for stored XSS exists in the catalog; CAPEC-1 is the narrowest defensible match for an output-encoding failure. Uncertainty: the pattern is broad and does not specifically name XSS, but it is the best available mapping for an input-escaping deficiency."}], "commit": "ce10436ae989a4580a35ada1557ff9d9107f43ed", "confidence": "medium", "credits": [{"lang": "en", "type": "reporter", "value": "Jeroen Pinoy"}, {"lang": "en", "type": "remediation developer", "value": "iglocska"}, {"lang": "en", "type": "remediation developer", "value": "Claude Opus 4.8"}], "cvssRationale": "AV:N: exploited over the network via the web UI. AC:L: the attacker simply creates a tag with a script payload; no race or complex condition. AT:N: no attack-target manipulation required. PR:L: the attacker needs tag-editor privileges (lower than admin) to create the crafted misp-galaxy tag. UI:P: the victim (site admin) must passively view the Galaxies index page for the script to execute. VC/VI/VA:N: the MISP application process itself is not directly compromised; the impact is on the victim's browser session. SC:H: the attacker can read the admin's session cookies, tokens, and data visible in the browser. SI:H: the attacker can perform authenticated actions as the admin via the compromised session. SA:N: no meaningful availability impact on the scope component.", "draft": false, "fixSummary": "The fix applies CakePHP's h() HTML-encoding function to each sample tag name before it is interpolated into the HTML notice. This ensures that any angle brackets, quotes, or ampersands contained in user-supplied tag names are rendered as inert HTML entities, preventing script execution in the administrator's browser.", "generatedAt": "2026-09-21T11:56:43.983892Z", "generator": "patch2vuln.py", "model": "qwen3.8:27b", "modelComparison": {"rankings": [{"agreementScore": 9, "assumptionCount": 6, "confidence": "medium", "model": "qwen3.8:27b", "score": 4}], "selectedModel": "qwen3.8:27b", "selectionMethod": "deterministic-consensus-v1", "selectionNotice": "The selected result is closest to model consensus; this heuristic does not establish factual correctness and human review remains required."}, "patchSha256": "c629d71fb493dcf9ae82dd54bd424cd4335e7638f3db46ec4c0ae90695abb535", "patchSummary": "In app/View/Galaxies/index.ctp, two lines that built $tagSampleHTML via sprintf and implode over the unknownCustomClustersSamples and unknownDefaultClustersSamples arrays were modified to wrap each array with array_map('h', ...) before the implode. This causes every element to pass through CakePHP's h() helper (HTML entity encoding) prior to concatenation into the <li> list markup. No other logic, routing, or authorization changes were made.", "patchTruncated": false, "patches": [{"commit": "ce10436ae989a4580a35ada1557ff9d9107f43ed", "patchSha256": "c629d71fb493dcf9ae82dd54bd424cd4335e7638f3db46ec4c0ae90695abb535", "source": "https://github.com/MISP/MISP/commit/ce10436ae.patch", "sourceUrl": "https://github.com/MISP/MISP/commit/ce10436ae.patch", "subject": "fix: [security] Escape unknown-cluster samples in the"}], "source": "https://github.com/MISP/MISP/commit/ce10436ae.patch", "subject": "fix: [security] Escape unknown-cluster samples in the", "tagVersionBoundary": {"commits_after_fix": 45, "repository": "https://github.com/MISP/MISP", "tag": "v2.5.47", "version": "2.5.47", "version_type": "semver"}, "weaknessRationale": [{"cweId": "CWE-79", "rationale": "User-controlled tag names (misp-galaxy tags created by a tag editor) are inserted into an HTML page without output encoding, allowing script injection. This is a classic stored XSS (CWE-79) where the dangerous data is persisted in the database and rendered unsafely in a server-side template."}]}}}, "recordType": "advisory", "vulnId": "GCVE-1-2026-20002"}]}}}

{}

{}

{}

{}