MISP contains a reflected cross-site scripting (XSS) vulnerability in the workflow module interface. Parameter names returned by the misp-modules service are rendered as raw HTML form labels on the workflow module page without output encoding. An attacker who can influence the parameter names reported by the misp-modules service can inject arbitrary HTML or JavaScript that executes in the context of an authenticated MISP user's browser.
Preconditions:
- The attacker must be able to control or influence parameter names reported by the misp-modules service.
- A victim must be authenticated and view the affected workflow module page.
Impact:
- Execution of arbitrary JavaScript in the victim's browser session.
- Potential theft of session tokens, manipulation of the MISP interface, or initiation of unauthorized actions on behalf of the victim.
Affected versions: <2.5.48.
"}],"value":"MISP contains a reflected cross-site scripting (XSS) vulnerability in the workflow module interface. Parameter names returned by the misp-modules service are rendered as raw HTML form labels on the workflow module page without output encoding. An attacker who can influence the parameter names reported by the misp-modules service can inject arbitrary HTML or JavaScript that executes in the context of an authenticated MISP user's browser.\n\nPreconditions:\n\n- The attacker must be able to control or influence parameter names reported by the misp-modules service.\n\n- A victim must be authenticated and view the affected workflow module page.\n\nImpact:\n\n- Execution of arbitrary JavaScript in the victim's browser session.\n\n- Potential theft of session tokens, manipulation of the MISP interface, or initiation of unauthorized actions on behalf of the victim.\n\nAffected versions: <2.5.48."}],"impacts":[{"capecId":"CAPEC-1","descriptions":[{"lang":"en","value":"CAPEC-1 XSS - Reflected"}]}],"metrics":[{"cvssV4_0":{"Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","Safety":"NOT_DEFINED","attackComplexity":"LOW","attackRequirements":"NONE","attackVector":"NETWORK","baseScore":4.8,"baseSeverity":"MEDIUM","privilegesRequired":"LOW","providerUrgency":"NOT_DEFINED","subAvailabilityImpact":"NONE","subConfidentialityImpact":"LOW","subIntegrityImpact":"LOW","userInteraction":"ACTIVE","valueDensity":"NOT_DEFINED","vectorString":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:A/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N","version":"4.0","vulnAvailabilityImpact":"NONE","vulnConfidentialityImpact":"NONE","vulnIntegrityImpact":"NONE","vulnerabilityResponseEffort":"NOT_DEFINED"},"format":"CVSS","scenarios":[{"lang":"en","value":"GENERAL"}]},{"format":"SSVC","other":{"content":{"options":[{"Exploitation":"none"},{"Automatable":"yes"},{"Technical Impact":"partial"}],"role":"Supplier","timestamp":"2026-10-19T09:16:56Z","version":"2.0.3"},"type":"SSVC"},"scenarios":[{"lang":"en","value":"GENERAL"}]}],"problemTypes":[{"descriptions":[{"cweId":"CWE-79","description":"CWE-79 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')","lang":"en","type":"CWE"}]}],"providerMetadata":{"dateUpdated":"2026-10-19T09:19:45.056Z","orgId":"5a6e4751-2f3f-4070-9419-94fb35b644e8","shortName":"CIRCL"},"references":[{"name":"Security patch","tags":["patch"],"url":"https://github.com/MISP/MISP/commit/813a48b2b"}],"solutions":[{"lang":"en","supportingMedia":[{"base64":false,"type":"text/html","value":"The fix applies HTML output encoding (the h() helper) to the parameter name before it is used as a form label, ensuring that any HTML metacharacters in the value are neutralized and rendered as inert text rather than executable markup.
"}],"value":"The fix applies HTML output encoding (the h() helper) to the parameter name before it is used as a form label, ensuring that any HTML metacharacters in the value are neutralized and rendered as inert text rather than executable markup."}],"title":"MISP Workflow Module: Reflected XSS via Unescaped misp-modules Parameter Names in Form Labels","x_gcve":[{"extensions":{"bcp-05-x-01":{"ai_annotations":[{"ai_level":"generated","description":"Draft vulnerability metadata was generated from a git-format patch using an Ollama-hosted language model. Human validation is required before publication.","gna_source":1,"models":[{"gna_source":1,"identifier":"qwen3.8:27b","name":"qwen3.8:27b","source":"ollama"}],"review_status":"full","scope":"record","tags":["ai-computer-assisted:llm-generated","ai-computer-assisted:classification"]}]},"bcp-05-x-02":{"x_patch2vuln":{"assumptions":["The misp-modules service is assumed to be a component whose output can be influenced by a module developer or a compromised service endpoint; the exact attack vector for injecting a malicious parameter name is not detailed in the patch.","MISP requires authentication to access the workflow module page; PR:L is assumed based on MISP's standard access model.","The affected version boundary (< 2.5.48) is inferred from the tag_version_boundary metadata (v2.5.48, 25 commits after fix); the exact first affected version is not specified.","CAPEC-1 (Reflected XSS) is the closest match; the data source is a backend service rather than a direct request parameter, but the unencoded reflection into HTML is the defining characteristic.","The h() function is assumed to be CakePHP's HTML-encoding helper (equivalent to htmlspecialchars), based on the framework context of the MISP codebase."],"capecRationale":[{"capecId":"CAPEC-1","rationale":"The misp-modules service supplies parameter names that are reflected into the HTML of the workflow module page without encoding. The attacker-controlled data flows from an external source into the rendered output, matching the reflected XSS pattern. Uncertainty: the data originates from a backend service rather than a direct HTTP parameter, but the effect (untrusted data reflected into HTML without encoding) is functionally identical to reflected XSS."}],"commit":"813a48b2bac0c9034f532b9181ac9a0c5fa59857","confidence":"medium","credits":[{"lang":"en","type":"reporter","value":"Jeroen Pinoy"},{"lang":"en","type":"remediation developer","value":"iglocska"},{"lang":"en","type":"remediation developer","value":"Claude Opus 5.5 (1M context)"}],"cvssRationale":"AV:N – web-based, reachable over the network. AC:L – no race or special timing; the misp-modules service simply needs to return a crafted parameter name. AT:N – no manipulation of the target system required. PR:L – the victim must be an authenticated MISP user to view the workflow module page. UI:A – the victim must actively load the workflow module page for the script to execute. VC/VI/VA:N – the MISP server itself is not compromised. SC:L – the attacker can read cookies or session data in the victim's browser. SI:L – the attacker can modify the page or perform actions in the victim's session. SA:N – no elevation of security authority on the server.","fixSummary":"The fix applies HTML output encoding (the h() helper) to the parameter name before it is used as a form label, ensuring that any HTML metacharacters in the value are neutralized and rendered as inert text rather than executable markup.","generatedAt":"2026-10-19T09:16:56.467726Z","generator":"patch2vuln.py","model":"qwen3.8:27b","modelComparison":{"rankings":[{"agreementScore":11,"assumptionCount":5,"confidence":"medium","model":"qwen3.8:27b","score":7}],"selectedModel":"qwen3.8:27b","selectionMethod":"deterministic-consensus-v1","selectionNotice":"The selected result is closest to model consensus; this heuristic does not establish factual correctness and human review remains required."},"patchSha256":"691d31d09a8db397d602b6d179507339a60ca0125e91b55d408353abf8473bac","patchSummary":"In app/Model/WorkflowModules/Module_misp_module.php, the translateParams method was modified: the 'label' array element changed from Inflector::humanize($paramName) to h(Inflector::humanize($paramName)), wrapping the humanized parameter name in CakePHP's HTML-encoding function before it is assigned as a form label.","patchTruncated":false,"patches":[{"commit":"813a48b2bac0c9034f532b9181ac9a0c5fa59857","date":"Fri, 25 Sep 2026 00:12:54 +0200","patchSha256":"691d31d09a8db397d602b6d179507339a60ca0125e91b55d408353abf8473bac","source":"https://github.com/MISP/MISP/commit/813a48b2b.patch","sourceUrl":"https://github.com/MISP/MISP/commit/813a48b2b.patch","subject":"fix: [workflows] Escape misp-module parameter names used as"}],"source":"https://github.com/MISP/MISP/commit/813a48b2b.patch","ssvc":{"options":[{"Exploitation":"none"},{"Automatable":"yes"},{"Technical Impact":"partial"}],"role":"Supplier","timestamp":"2026-10-19T09:16:56Z","version":"2.0.3"},"subject":"fix: [workflows] Escape misp-module parameter names used as","tagVersionBoundary":{"commits_after_fix":25,"repository":"https://github.com/MISP/MISP","tag":"v2.5.48","version":"2.5.48","version_type":"semver"},"weaknessRationale":[{"cweId":"CWE-79","rationale":"The parameter name from an external service is inserted into HTML output (a form label) without HTML encoding, allowing injected markup or script to execute in the victim's browser. This is a textbook reflected XSS."}]}},"bcp-05-x-03":{"x_timeline":{"events":[{"description":"Corrective change authored (813a48b2bac0c9034f532b9181ac9a0c5fa59857): fix: [workflows] Escape misp-module parameter names used as","id":"evt-fix-developed-1","references":["https://github.com/MISP/MISP/commit/813a48b2b.patch"],"timestamp":"2026-09-24T22:12:54Z","type":"fix-developed"}]}}},"recordType":"advisory","vulnId":"GCVE-1-2026-20332"}]}},"cveMetadata":{"assignerOrgId":"5a6e4751-2f3f-4070-9419-94fb35b644e8","assignerShortName":"CIRCL","cveId":"CVE-2026-112184","datePublished":"2026-10-19T09:19:45.056Z","dateReserved":"2026-10-19T09:19:41.258Z","dateUpdated":"2026-10-19T17:14:52.401Z","state":"PUBLISHED"},"dataType":"CVE_RECORD","dataVersion":"5.2"},"nvd":{"publishedDate":"2026-10-19 10:16:47","lastModifiedDate":"2026-10-19 18:17:03","problem_types":["CWE-79","CWE-79 CWE-79 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')"],"metrics":{"cvssMetricV40":[{"source":"5a6e4751-2f3f-4070-9419-94fb35b644e8","type":"Secondary","cvssData":{"version":"4.0","vectorString":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:A/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","baseScore":4.8,"baseSeverity":"MEDIUM","attackVector":"NETWORK","attackComplexity":"LOW","attackRequirements":"NONE","privilegesRequired":"LOW","userInteraction":"ACTIVE","vulnConfidentialityImpact":"NONE","vulnIntegrityImpact":"NONE","vulnAvailabilityImpact":"NONE","subConfidentialityImpact":"LOW","subIntegrityImpact":"LOW","subAvailabilityImpact":"NONE","exploitMaturity":"NOT_DEFINED","confidentialityRequirement":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","availabilityRequirement":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","Safety":"NOT_DEFINED","Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","valueDensity":"NOT_DEFINED","vulnerabilityResponseEffort":"NOT_DEFINED","providerUrgency":"NOT_DEFINED"}}],"ssvcV203":[{"source":"5a6e4751-2f3f-4070-9419-94fb35b644e8","ssvcData":{"timestamp":"2026-10-19T09:16:56Z","options":[{"exploitation":"none"},{"automatable":"yes"},{"technicalImpact":"partial"}],"role":"Supplier","version":"2.0.3"}},{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-10-19T17:14:29.630953Z","id":"CVE-2026-112184","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"configurations":[]},"legacy_mitre":{"record":{"CveYear":"2026","CveId":"112184","Ordinal":"1","Title":"MISP Workflow Module: Reflected XSS via Unescaped misp-modules P","CVE":"CVE-2026-112184","Year":"2026"},"notes":[{"CveYear":"2026","CveId":"112184","Ordinal":"1","NoteData":"MISP contains a reflected cross-site scripting (XSS) vulnerability in the workflow module interface. Parameter names returned by the misp-modules service are rendered as raw HTML form labels on the workflow module page without output encoding. An attacker who can influence the parameter names reported by the misp-modules service can inject arbitrary HTML or JavaScript that executes in the context of an authenticated MISP user's browser.\n\nPreconditions:\n\n- The attacker must be able to control or influence parameter names reported by the misp-modules service.\n\n- A victim must be authenticated and view the affected workflow module page.\n\nImpact:\n\n- Execution of arbitrary JavaScript in the victim's browser session.\n\n- Potential theft of session tokens, manipulation of the MISP interface, or initiation of unauthorized actions on behalf of the victim.\n\nAffected versions: <2.5.48.","Type":"Description","Title":"MISP Workflow Module: Reflected XSS via Unescaped misp-modules P"}]}}}