MISP contains a stored cross-site scripting (XSS) vulnerability in the galaxy icon handling path. The icon field of a galaxy object was persisted without any server-side validation through the galaxy add, edit, and sync/import capture endpoints. The stored value was subsequently concatenated directly into HTML markup by the D3-based correlation graph rendering scripts (both the default and Overmind themes) using the .html() method.
A user holding the perm_galaxy_editor permission, which is granted to the stock User role, could store arbitrary HTML or JavaScript in the icon field. Any other user who opened the correlation graph of an event containing a cluster belonging to that galaxy would have the injected script executed in their browser session.
Impact:
- Arbitrary script execution in the context of the victim's MISP session
- Potential theft of session credentials, manipulation of displayed data, or initiation of actions on behalf of the victim
- Affects both the default and Overmind UI themes
Affected versions: <2.5.48
"}],"value":"MISP contains a stored cross-site scripting (XSS) vulnerability in the galaxy icon handling path. The icon field of a galaxy object was persisted without any server-side validation through the galaxy add, edit, and sync/import capture endpoints. The stored value was subsequently concatenated directly into HTML markup by the D3-based correlation graph rendering scripts (both the default and Overmind themes) using the .html() method.\n\nA user holding the perm_galaxy_editor permission, which is granted to the stock User role, could store arbitrary HTML or JavaScript in the icon field. Any other user who opened the correlation graph of an event containing a cluster belonging to that galaxy would have the injected script executed in their browser session.\n\nImpact:\n\n- Arbitrary script execution in the context of the victim's MISP session\n\n- Potential theft of session credentials, manipulation of displayed data, or initiation of actions on behalf of the victim\n\n- Affects both the default and Overmind UI themes\n\nAffected versions: <2.5.48"}],"impacts":[{"capecId":"CAPEC-1","descriptions":[{"lang":"en","value":"CAPEC-1 Cross Site Scripting"}]}],"metrics":[{"cvssV4_0":{"Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","Safety":"NOT_DEFINED","attackComplexity":"LOW","attackRequirements":"NONE","attackVector":"NETWORK","baseScore":6.2,"baseSeverity":"MEDIUM","privilegesRequired":"LOW","providerUrgency":"NOT_DEFINED","subAvailabilityImpact":"NONE","subConfidentialityImpact":"HIGH","subIntegrityImpact":"HIGH","userInteraction":"ACTIVE","valueDensity":"NOT_DEFINED","vectorString":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:A/VC:N/VI:N/VA:N/SC:H/SI:H/SA:N","version":"4.0","vulnAvailabilityImpact":"NONE","vulnConfidentialityImpact":"NONE","vulnIntegrityImpact":"NONE","vulnerabilityResponseEffort":"NOT_DEFINED"},"format":"CVSS","scenarios":[{"lang":"en","value":"GENERAL"}]}],"problemTypes":[{"descriptions":[{"cweId":"CWE-79","description":"CWE-79 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')","lang":"en","type":"CWE"}]},{"descriptions":[{"cweId":"CWE-20","description":"CWE-20 Improper Input Validation","lang":"en","type":"CWE"}]}],"providerMetadata":{"dateUpdated":"2026-09-30T14:25:59.230Z","orgId":"5a6e4751-2f3f-4070-9419-94fb35b644e8","shortName":"CIRCL"},"references":[{"name":"Security patch","tags":["patch"],"url":"https://github.com/MISP/MISP/commit/8ea5783dd"}],"solutions":[{"lang":"en","supportingMedia":[{"base64":false,"type":"text/html","value":"The vulnerability is remediated by enforcing strict input validation on the galaxy icon field so that only valid Font Awesome icon names (lowercase alphanumeric characters and dashes) are accepted at write time. The sync/import capture path discards any icon value that does not conform. The correlation graph JSON generation falls back to a safe default icon for any previously stored invalid value. On the client side, both correlation graph scripts now set the icon as a CSS class attribute rather than injecting it as raw HTML, and apply an additional regex sanitization pass. The asset cache-busting version is incremented to ensure browsers load the corrected scripts.
"}],"value":"The vulnerability is remediated by enforcing strict input validation on the galaxy icon field so that only valid Font Awesome icon names (lowercase alphanumeric characters and dashes) are accepted at write time. The sync/import capture path discards any icon value that does not conform. The correlation graph JSON generation falls back to a safe default icon for any previously stored invalid value. On the client side, both correlation graph scripts now set the icon as a CSS class attribute rather than injecting it as raw HTML, and apply an additional regex sanitization pass. The asset cache-busting version is incremented to ensure browsers load the corrected scripts."}],"title":"MISP Stored Cross-Site Scripting via Unvalidated Galaxy Icon Field in Correlation Graph","x_gcve":[{"extensions":{"bcp-05-x-01":{"ai_annotations":[{"ai_level":"generated","description":"Draft vulnerability metadata was generated from a git-format patch using an Ollama-hosted language model. Human validation is required before publication.","gna_source":1,"models":[{"gna_source":1,"identifier":"qwen3.8:27b","name":"qwen3.8:27b","source":"ollama"}],"review_status":"full","scope":"record","tags":["ai-computer-assisted:llm-generated","ai-computer-assisted:classification"]}]},"bcp-05-x-02":{"x_patch2vuln":{"assumptions":["The affected version boundary is inferred from the tag_version_boundary metadata indicating the fix commit precedes v2.5.48 by 20 commits; no explicit 'fixed in' version is stated in the patch itself.","The perm_galaxy_editor permission is assumed to be granted to the stock User role as stated in the commit message; the exact role-permission mapping was not independently verified from the patch.","CAPEC-1 is the closest available mapping; no CAPEC entry specifically describes stored XSS via a graph-rendering library data field, so the general Cross Site Scripting pattern is used.","CVSS UI:A assumes the victim must navigate to the correlation graph view of a specific event; if the graph is auto-loaded on a commonly visited page, UI could be lowered to Passive.","The Co-Authored-By line references an AI assistant (Claude Fable 5.1); it is recorded as a tool credit rather than a human remediation developer."],"capecRationale":[{"capecId":"CAPEC-1","rationale":"The attack pattern is a stored XSS: an authenticated user with galaxy editor permission injects a script payload into a persistent data field (galaxy icon), which is later rendered unsanitized in another user's browser via the correlation graph. CAPEC-1 is the closest and most direct match. No more specific CAPEC entry for stored XSS via a data field rendered by a graphing library exists in the CAPEC catalog, so CAPEC-1 is the best available mapping."}],"commit":"8ea5783ddcfe69be6013337a0d6732ac75a862e6","confidence":"high","credits":[{"lang":"en","type":"reporter","value":"Jeroen Pinoy"},{"lang":"en","type":"remediation developer","value":"iglocska"},{"lang":"en","type":"remediation developer","value":"Claude Fable 5.1"},{"lang":"en","type":"tool","value":"Claude Fable 5.1"}],"cvssRationale":"AV:N: exploited over the network via the MISP web interface. AC:L: no race conditions or special timing; simply set the icon field and wait for a victim to view the graph. AT:N: no manipulation of the attack target required. PR:L: requires an authenticated user with perm_galaxy_editor, which is the default stock User role. UI:A: the victim must actively open the correlation graph of an event containing the affected galaxy cluster. VC/VI/VA:N: the server-side application is not directly compromised; the impact is on the victim's browser session. SC:H: script execution in the victim's session can read cookies, tokens, and sensitive page data. SI:H: the attacker can modify the victim's view, inject content, or trigger actions. SA:N: no availability impact on the system.","fixSummary":"The vulnerability is remediated by enforcing strict input validation on the galaxy icon field so that only valid Font Awesome icon names (lowercase alphanumeric characters and dashes) are accepted at write time. The sync/import capture path discards any icon value that does not conform. The correlation graph JSON generation falls back to a safe default icon for any previously stored invalid value. On the client side, both correlation graph scripts now set the icon as a CSS class attribute rather than injecting it as raw HTML, and apply an additional regex sanitization pass. The asset cache-busting version is incremented to ensure browsers load the corrected scripts.","generatedAt":"2026-09-30T14:24:01.890608Z","generator":"patch2vuln.py","model":"qwen3.8:27b","modelComparison":{"rankings":[{"agreementScore":9,"assumptionCount":5,"confidence":"high","model":"qwen3.8:27b","score":6}],"selectedModel":"qwen3.8:27b","selectionMethod":"deterministic-consensus-v1","selectionNotice":"The selected result is closest to model consensus; this heuristic does not establish factual correctness and human review remains required."},"patchSha256":"382869c811e8df5875a463c4b6275f754f4969445196f08d708cfee926528b0f","patchSummary":"Added a static isValidIconName() method and a regex constant (ICON_NAME_PATTERN) to the Galaxy model, plus a model-level validation rule restricting the icon field to lowercase letters, digits, and dashes. The captureGalaxy() method now blanks out any icon value that fails validation before persistence. CorrelationGraphTool::__createNode() now checks the icon against the validator and substitutes 'globe' for invalid stored values. Both correlation-graph.js and correlation-graphOvermind.js were changed from .html() string concatenation to .attr('class', ...) with a regex strip of non-conforming characters. AppController asset query version bumped from 225 to 226. A new PHPUnit test file (GalaxyIconNameTest.php) validates the icon name rule against known-good and known-bad payloads including the originally reported XSS vector.","patchTruncated":false,"patches":[{"commit":"8ea5783ddcfe69be6013337a0d6732ac75a862e6","patchSha256":"382869c811e8df5875a463c4b6275f754f4969445196f08d708cfee926528b0f","source":"https://github.com/MISP/MISP/commit/8ea5783dd.patch","sourceUrl":"https://github.com/MISP/MISP/commit/8ea5783dd.patch","subject":"fix: [security] Galaxy icons are icon names, and the"}],"source":"https://github.com/MISP/MISP/commit/8ea5783dd.patch","subject":"fix: [security] Galaxy icons are icon names, and the","tagVersionBoundary":{"commits_after_fix":20,"repository":"https://github.com/MISP/MISP","tag":"v2.5.48","version":"2.5.48","version_type":"semver"},"weaknessRationale":[{"cweId":"CWE-79","rationale":"The galaxy icon field was stored without validation and later rendered into the DOM via D3 .html(), allowing an attacker to inject and execute arbitrary script in the victim's browser. This is a textbook stored XSS."},{"cweId":"CWE-20","rationale":"The root enabler is the absence of any server-side validation on the icon field at write time (add, edit, capture). The field accepted arbitrary strings including HTML markup, which was the precondition for the XSS."}]}}},"recordType":"advisory","vulnId":"GCVE-1-2026-20142"}]}},"cveMetadata":{"assignerOrgId":"5a6e4751-2f3f-4070-9419-94fb35b644e8","assignerShortName":"CIRCL","cveId":"CVE-2026-103389","datePublished":"2026-09-30T14:25:59.230Z","dateReserved":"2026-09-30T14:25:56.802Z","dateUpdated":"2026-09-30T15:28:06.728Z","state":"PUBLISHED"},"dataType":"CVE_RECORD","dataVersion":"5.2"},"nvd":{"publishedDate":"2026-09-30 15:22:27","lastModifiedDate":"2026-09-30 16:17:09","problem_types":["CWE-20","CWE-79","CWE-79 CWE-79 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')","CWE-20 CWE-20 Improper Input Validation"],"metrics":{"cvssMetricV40":[{"source":"5a6e4751-2f3f-4070-9419-94fb35b644e8","type":"Secondary","cvssData":{"version":"4.0","vectorString":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:A/VC:N/VI:N/VA:N/SC:H/SI:H/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","baseScore":6.2,"baseSeverity":"MEDIUM","attackVector":"NETWORK","attackComplexity":"LOW","attackRequirements":"NONE","privilegesRequired":"LOW","userInteraction":"ACTIVE","vulnConfidentialityImpact":"NONE","vulnIntegrityImpact":"NONE","vulnAvailabilityImpact":"NONE","subConfidentialityImpact":"HIGH","subIntegrityImpact":"HIGH","subAvailabilityImpact":"NONE","exploitMaturity":"NOT_DEFINED","confidentialityRequirement":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","availabilityRequirement":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","Safety":"NOT_DEFINED","Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","valueDensity":"NOT_DEFINED","vulnerabilityResponseEffort":"NOT_DEFINED","providerUrgency":"NOT_DEFINED"}}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-09-30T14:58:27.715153Z","id":"CVE-2026-103389","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"configurations":[]},"legacy_mitre":{"record":{"CveYear":"2026","CveId":"103389","Ordinal":"1","Title":"MISP Stored Cross-Site Scripting via Unvalidated Galaxy Icon Fie","CVE":"CVE-2026-103389","Year":"2026"},"notes":[{"CveYear":"2026","CveId":"103389","Ordinal":"1","NoteData":"MISP contains a stored cross-site scripting (XSS) vulnerability in the galaxy icon handling path. The icon field of a galaxy object was persisted without any server-side validation through the galaxy add, edit, and sync/import capture endpoints. The stored value was subsequently concatenated directly into HTML markup by the D3-based correlation graph rendering scripts (both the default and Overmind themes) using the .html() method.\n\nA user holding the perm_galaxy_editor permission, which is granted to the stock User role, could store arbitrary HTML or JavaScript in the icon field. Any other user who opened the correlation graph of an event containing a cluster belonging to that galaxy would have the injected script executed in their browser session.\n\nImpact:\n\n- Arbitrary script execution in the context of the victim's MISP session\n\n- Potential theft of session credentials, manipulation of displayed data, or initiation of actions on behalf of the victim\n\n- Affects both the default and Overmind UI themes\n\nAffected versions: <2.5.48","Type":"Description","Title":"MISP Stored Cross-Site Scripting via Unvalidated Galaxy Icon Fie"}]}}}