MISP contains a CSS injection vulnerability in the remote event preview feature. When a user previews an event from a linked MISP server, the colour value associated with each remote tag is written directly into an inline CSS style attribute without sufficient validation. Although HTML entity encoding is applied, the value is interpreted as CSS within the style attribute, allowing a malicious or compromised linked server to inject arbitrary CSS declarations.
An attacker with the ability to create or modify tags on a linked MISP instance can craft a tag colour value containing CSS injection payloads. When a user on the local instance views the event preview, the injected CSS is rendered, potentially allowing UI manipulation, visual spoofing, or limited information disclosure through CSS-based techniques.
Preconditions:
- A linked MISP server relationship exists between the victim instance and the attacker-controlled instance.
- The attacker can create or modify tags on the linked server.
- A victim user views the remote event preview page.
Affected: <2.5.48.
"}],"value":"MISP contains a CSS injection vulnerability in the remote event preview feature. When a user previews an event from a linked MISP server, the colour value associated with each remote tag is written directly into an inline CSS style attribute without sufficient validation. Although HTML entity encoding is applied, the value is interpreted as CSS within the style attribute, allowing a malicious or compromised linked server to inject arbitrary CSS declarations.\n\nAn attacker with the ability to create or modify tags on a linked MISP instance can craft a tag colour value containing CSS injection payloads. When a user on the local instance views the event preview, the injected CSS is rendered, potentially allowing UI manipulation, visual spoofing, or limited information disclosure through CSS-based techniques.\n\nPreconditions:\n\n- A linked MISP server relationship exists between the victim instance and the attacker-controlled instance.\n\n- The attacker can create or modify tags on the linked server.\n\n- A victim user views the remote event preview page.\n\nAffected: <2.5.48."}],"impacts":[{"capecId":"CAPEC-66","descriptions":[{"lang":"en","value":"CAPEC-66 Leveraging Trusted Relationships"}]}],"metrics":[{"cvssV4_0":{"Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","Safety":"NOT_DEFINED","attackComplexity":"LOW","attackRequirements":"NONE","attackVector":"NETWORK","baseScore":4.8,"baseSeverity":"MEDIUM","privilegesRequired":"LOW","providerUrgency":"NOT_DEFINED","subAvailabilityImpact":"NONE","subConfidentialityImpact":"LOW","subIntegrityImpact":"LOW","userInteraction":"ACTIVE","valueDensity":"NOT_DEFINED","vectorString":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:A/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N","version":"4.0","vulnAvailabilityImpact":"NONE","vulnConfidentialityImpact":"NONE","vulnIntegrityImpact":"NONE","vulnerabilityResponseEffort":"NOT_DEFINED"},"format":"CVSS","scenarios":[{"lang":"en","value":"GENERAL"}]},{"format":"SSVC","other":{"content":{"options":[{"Exploitation":"none"},{"Automatable":"yes"},{"Technical Impact":"partial"}],"role":"Supplier","timestamp":"2026-10-19T09:01:35Z","version":"2.0.3"},"type":"SSVC"},"scenarios":[{"lang":"en","value":"GENERAL"}]}],"problemTypes":[{"descriptions":[{"cweId":"CWE-74","description":"CWE-74 Improper Neutralization of Special Elements in Output Used by a Downstream Component","lang":"en","type":"CWE"}]}],"providerMetadata":{"dateUpdated":"2026-10-19T09:15:47.453Z","orgId":"5a6e4751-2f3f-4070-9419-94fb35b644e8","shortName":"CIRCL"},"references":[{"name":"Security patch","tags":["patch"],"url":"https://github.com/MISP/MISP/commit/91323b517"}],"solutions":[{"lang":"en","supportingMedia":[{"base64":false,"type":"text/html","value":"The fix introduces strict validation of the tag colour value before it is rendered into a CSS style attribute. Only values matching a valid six-digit hexadecimal colour pattern (e.g. #aabbcc) are accepted; any other value is replaced with a safe default (#ffffff). This prevents arbitrary CSS from being injected through the colour field, aligning the remote tag handling with the validation already applied to local tags.
"}],"value":"The fix introduces strict validation of the tag colour value before it is rendered into a CSS style attribute. Only values matching a valid six-digit hexadecimal colour pattern (e.g. #aabbcc) are accepted; any other value is replaced with a safe default (#ffffff). This prevents arbitrary CSS from being injected through the colour field, aligning the remote tag handling with the validation already applied to local tags."}],"title":"MISP CSS Injection via Remote Tag Colour in Event Preview","x_gcve":[{"extensions":{"bcp-05-x-01":{"ai_annotations":[{"ai_level":"generated","description":"Draft vulnerability metadata was generated from a git-format patch using an Ollama-hosted language model. Human validation is required before publication.","gna_source":1,"models":[{"gna_source":1,"identifier":"qwen3.8:27b","name":"qwen3.8:27b","source":"ollama"}],"review_status":"full","scope":"record","tags":["ai-computer-assisted:llm-generated","ai-computer-assisted:classification"]}]},"bcp-05-x-02":{"x_patch2vuln":{"assumptions":["The affected version boundary is inferred from the tag_version_boundary metadata (v2.5.48, 27 commits after fix); the exact first affected version is not stated in the patch.","PR:L assumes that creating or modifying a tag on a linked MISP server requires only low-level user privileges; the exact permission model was not verified from the patch.","SC:L assumes CSS injection could enable limited client-side information disclosure (e.g., via CSS selectors or layout manipulation); full XSS or data exfiltration is not evidenced.","CAPEC-66 is the closest available mapping; no CAPEC specifically models CSS injection via trusted inter-instance data, so this mapping carries uncertainty.","The commit message states the issue was found during internal review and not externally reported; no external finder or reporter is credited.","The Co-Authored-By line references an AI tool (Claude Opus 5.5); it is credited as a tool rather than a human remediation developer."],"capecRationale":[{"capecId":"CAPEC-66","rationale":"The attack exploits the inherent trust between linked MISP instances. The local instance accepts and renders data (tag colours) from a remote linked server without sufficient validation, assuming the data is well-formed. The attacker leverages this trusted relationship to inject CSS. This is the closest CAPEC; no CAPEC specifically models CSS injection via trusted data sources, so CAPEC-66 is the best available match."}],"commit":"91323b517bb5a34f413363faf8703a3c0a1a9904","confidence":"medium","credits":[{"lang":"en","type":"remediation developer","value":"iglocska"},{"lang":"en","type":"remediation developer","value":"Claude Opus 5.5 (1M context)"}],"cvssRationale":"AV:N – the attack originates from a remote linked MISP server over the network. AC:L – no race conditions or special timing; simply setting a tag colour suffices. AT:N – no manipulation of the attack target is required. PR:L – the attacker needs low-privilege access (tag creation) on the linked server. UI:A – the victim must actively navigate to the event preview page. VC:N – no direct confidentiality loss on the vulnerable system. VI:N – no integrity impact on the vulnerable system's data. VA:N – no availability impact. SC:L – CSS injection may allow limited information disclosure on the client (e.g., reading page structure via CSS selectors or side channels). SI:L – the attacker can modify the visual presentation of the preview page (UI manipulation, overlay, spoofing). SA:N – no security authority impact.","fixSummary":"The fix introduces strict validation of the tag colour value before it is rendered into a CSS style attribute. Only values matching a valid six-digit hexadecimal colour pattern (e.g. #aabbcc) are accepted; any other value is replaced with a safe default (#ffffff). This prevents arbitrary CSS from being injected through the colour field, aligning the remote tag handling with the validation already applied to local tags.","generatedAt":"2026-10-19T09:01:35.918427Z","generator":"patch2vuln.py","model":"qwen3.8:27b","modelComparison":{"rankings":[{"agreementScore":11,"assumptionCount":6,"confidence":"medium","model":"qwen3.8:27b","score":6}],"selectedModel":"qwen3.8:27b","selectionMethod":"deterministic-consensus-v1","selectionNotice":"The selected result is closest to model consensus; this heuristic does not establish factual correctness and human review remains required."},"patchSha256":"8be436940ffd0e21b7145fcb604ebfb0b529f6bbac717ee5cdf38c2e0dc2904e","patchSummary":"In app/View/Servers/preview_event.ctp, a regex check (preg_match against /^#[0-9a-f]{6}$/i) is added before the tag colour is used. If the colour does not match the hex pattern, it defaults to #ffffff. The validated $colour variable replaces the raw $tag['colour'] in both the background-color style property and the getTextColour() call, eliminating the untrusted value from the CSS context.","patchTruncated":false,"patches":[{"commit":"91323b517bb5a34f413363faf8703a3c0a1a9904","date":"Thu, 24 Sep 2026 23:54:30 +0200","patchSha256":"8be436940ffd0e21b7145fcb604ebfb0b529f6bbac717ee5cdf38c2e0dc2904e","source":"https://github.com/MISP/MISP/commit/91323b517.patch","sourceUrl":"https://github.com/MISP/MISP/commit/91323b517.patch","subject":"fix: [sync] Only use a valid colour for remote tags in the"}],"source":"https://github.com/MISP/MISP/commit/91323b517.patch","ssvc":{"options":[{"Exploitation":"none"},{"Automatable":"yes"},{"Technical Impact":"partial"}],"role":"Supplier","timestamp":"2026-10-19T09:01:35Z","version":"2.0.3"},"subject":"fix: [sync] Only use a valid colour for remote tags in the","tagVersionBoundary":{"commits_after_fix":27,"repository":"https://github.com/MISP/MISP","tag":"v2.5.48","version":"2.5.48","version_type":"semver"},"weaknessRationale":[{"cweId":"CWE-74","rationale":"The tag colour value is not neutralized for the CSS context in which it is placed. HTML entity encoding (h()) does not sanitize CSS metacharacters such as semicolons, colons, or function calls, allowing CSS injection. CWE-74 is the most precise parent weakness covering injection into a downstream component (CSS) without a more specific child CWE for CSS injection."}]}},"bcp-05-x-03":{"x_timeline":{"events":[{"description":"Corrective change authored (91323b517bb5a34f413363faf8703a3c0a1a9904): fix: [sync] Only use a valid colour for remote tags in the","id":"evt-fix-developed-1","references":["https://github.com/MISP/MISP/commit/91323b517.patch"],"timestamp":"2026-09-24T21:54:30Z","type":"fix-developed"}]}}},"recordType":"advisory","vulnId":"GCVE-1-2026-20339"}]}},"cveMetadata":{"assignerOrgId":"5a6e4751-2f3f-4070-9419-94fb35b644e8","assignerShortName":"CIRCL","cveId":"CVE-2026-112183","datePublished":"2026-10-19T09:15:47.453Z","dateReserved":"2026-10-19T09:15:45.556Z","dateUpdated":"2026-10-19T17:15:45.687Z","state":"PUBLISHED"},"dataType":"CVE_RECORD","dataVersion":"5.2"},"nvd":{"publishedDate":"2026-10-19 10:16:46","lastModifiedDate":"2026-10-19 18:17:03","problem_types":["CWE-74","CWE-74 CWE-74 Improper Neutralization of Special Elements in Output Used by a Downstream Component"],"metrics":{"cvssMetricV40":[{"source":"5a6e4751-2f3f-4070-9419-94fb35b644e8","type":"Secondary","cvssData":{"version":"4.0","vectorString":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:A/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","baseScore":4.8,"baseSeverity":"MEDIUM","attackVector":"NETWORK","attackComplexity":"LOW","attackRequirements":"NONE","privilegesRequired":"LOW","userInteraction":"ACTIVE","vulnConfidentialityImpact":"NONE","vulnIntegrityImpact":"NONE","vulnAvailabilityImpact":"NONE","subConfidentialityImpact":"LOW","subIntegrityImpact":"LOW","subAvailabilityImpact":"NONE","exploitMaturity":"NOT_DEFINED","confidentialityRequirement":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","availabilityRequirement":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","Safety":"NOT_DEFINED","Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","valueDensity":"NOT_DEFINED","vulnerabilityResponseEffort":"NOT_DEFINED","providerUrgency":"NOT_DEFINED"}}],"ssvcV203":[{"source":"5a6e4751-2f3f-4070-9419-94fb35b644e8","ssvcData":{"timestamp":"2026-10-19T09:01:35Z","options":[{"exploitation":"none"},{"automatable":"yes"},{"technicalImpact":"partial"}],"role":"Supplier","version":"2.0.3"}},{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-10-19T17:15:24.498800Z","id":"CVE-2026-112183","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"configurations":[]},"legacy_mitre":{"record":{"CveYear":"2026","CveId":"112183","Ordinal":"1","Title":"MISP CSS Injection via Remote Tag Colour in Event Preview","CVE":"CVE-2026-112183","Year":"2026"},"notes":[{"CveYear":"2026","CveId":"112183","Ordinal":"1","NoteData":"MISP contains a CSS injection vulnerability in the remote event preview feature. When a user previews an event from a linked MISP server, the colour value associated with each remote tag is written directly into an inline CSS style attribute without sufficient validation. Although HTML entity encoding is applied, the value is interpreted as CSS within the style attribute, allowing a malicious or compromised linked server to inject arbitrary CSS declarations.\n\nAn attacker with the ability to create or modify tags on a linked MISP instance can craft a tag colour value containing CSS injection payloads. When a user on the local instance views the event preview, the injected CSS is rendered, potentially allowing UI manipulation, visual spoofing, or limited information disclosure through CSS-based techniques.\n\nPreconditions:\n\n- A linked MISP server relationship exists between the victim instance and the attacker-controlled instance.\n\n- The attacker can create or modify tags on the linked server.\n\n- A victim user views the remote event preview page.\n\nAffected: <2.5.48.","Type":"Description","Title":"MISP CSS Injection via Remote Tag Colour in Event Preview"}]}}}