MISP contains a reflected cross-site scripting (XSS) vulnerability in the AnalystDataController::viewForObject action. The method accepted a parent object type parameter from the URL without validation and passed it to the Overmind-themed AnalystData thread view element, where it was interpolated into two translated strings and rendered into the HTML response without output encoding. An authenticated attacker who can induce a victim to navigate to a crafted URL can inject arbitrary JavaScript that executes in the victim's browser within the MISP application context. This may allow the attacker to read session data, manipulate the page, or perform actions on behalf of the victim.
The vulnerability requires the victim to be authenticated to MISP and to actively visit the attacker-supplied URL. The affected component is the AnalystData controller and the Overmind theme's AnalystData thread element.
Version affected: <2.5.47
"}],"value":"MISP contains a reflected cross-site scripting (XSS) vulnerability in the AnalystDataController::viewForObject action. The method accepted a parent object type parameter from the URL without validation and passed it to the Overmind-themed AnalystData thread view element, where it was interpolated into two translated strings and rendered into the HTML response without output encoding. An authenticated attacker who can induce a victim to navigate to a crafted URL can inject arbitrary JavaScript that executes in the victim's browser within the MISP application context. This may allow the attacker to read session data, manipulate the page, or perform actions on behalf of the victim. \n\nThe vulnerability requires the victim to be authenticated to MISP and to actively visit the attacker-supplied URL. The affected component is the AnalystData controller and the Overmind theme's AnalystData thread element.\n\nVersion affected: <2.5.47"}],"impacts":[{"capecId":"CAPEC-127","descriptions":[{"lang":"en","value":"CAPEC-127 Cross Site Scripting (Reflected)"}]},{"capecId":"CAPEC-61","descriptions":[{"lang":"en","value":"CAPEC-61 Cross Site Scripting"}]}],"metrics":[{"cvssV4_0":{"Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","Safety":"NOT_DEFINED","attackComplexity":"LOW","attackRequirements":"NONE","attackVector":"NETWORK","baseScore":4.8,"baseSeverity":"MEDIUM","privilegesRequired":"LOW","providerUrgency":"NOT_DEFINED","subAvailabilityImpact":"NONE","subConfidentialityImpact":"LOW","subIntegrityImpact":"LOW","userInteraction":"ACTIVE","valueDensity":"NOT_DEFINED","vectorString":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:A/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N","version":"4.0","vulnAvailabilityImpact":"NONE","vulnConfidentialityImpact":"NONE","vulnIntegrityImpact":"NONE","vulnerabilityResponseEffort":"NOT_DEFINED"},"format":"CVSS","scenarios":[{"lang":"en","value":"GENERAL"}]}],"problemTypes":[{"descriptions":[{"cweId":"CWE-79","description":"CWE-79 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')","lang":"en","type":"CWE"}]},{"descriptions":[{"cweId":"CWE-116","description":"CWE-116 Improper Encoding or Escaping of Output","lang":"en","type":"CWE"}]},{"descriptions":[{"cweId":"CWE-20","description":"CWE-20 Improper Input Validation","lang":"en","type":"CWE"}]}],"providerMetadata":{"dateUpdated":"2026-09-22T12:41:31.639Z","orgId":"5a6e4751-2f3f-4070-9419-94fb35b644e8","shortName":"CIRCL"},"references":[{"name":"Security patch","tags":["patch"],"url":"https://github.com/MISP/MISP/commit/23b879073"}],"solutions":[{"lang":"en","supportingMedia":[{"base64":false,"type":"text/html","value":"The fix introduces two layers of defense. First, the viewForObject action now validates the object_type parameter against the AnalystData::valid_targets whitelist and rejects any value not in that list with a NotFoundException, preventing arbitrary strings from reaching the view layer. Second, the two output sinks in the Overmind thread.ctp template now apply the h() HTML-encoding function to the object type before interpolation into translated strings, ensuring that even if a valid type were to contain special characters, it would be rendered as inert text rather than executable markup.
"}],"value":"The fix introduces two layers of defense. First, the viewForObject action now validates the object_type parameter against the AnalystData::valid_targets whitelist and rejects any value not in that list with a NotFoundException, preventing arbitrary strings from reaching the view layer. Second, the two output sinks in the Overmind thread.ctp template now apply the h() HTML-encoding function to the object type before interpolation into translated strings, ensuring that even if a valid type were to contain special characters, it would be rendered as inert text rather than executable markup."}],"source":{"discovery":"UNKNOWN"},"title":"MISP Reflected XSS via Unvalidated Object Type in AnalystData Overmind Thread","x_gcve":[{"extensions":{"bcp-05-x-01":{"ai_annotations":[{"ai_level":"generated","description":"Draft vulnerability metadata was generated from a git-format patch using an Ollama-hosted language model. Human validation is required before publication.","gna_source":1,"models":[{"gna_source":1,"identifier":"qwen3.8:27b","name":"qwen3.8:27b","source":"ollama"}],"review_status":"full","scope":"record","tags":["ai-computer-assisted:llm-generated","ai-computer-assisted:classification"]}]},"bcp-05-x-02":{"x_patch2vuln":{"assumptions":["The affected version range is inferred from the tag_version_boundary metadata (v2.5.47 with 58 commits after the fix), suggesting the fix is included in v2.5.47. The exact first affected version is not specified in the patch.","PR:L assumes the AnalystData viewForObject action requires authentication, which is consistent with MISP's typical access model but not explicitly confirmed in the patch.","UI:A assumes the victim must actively navigate to a crafted URL (e.g., click a link). If the malicious URL could be loaded in an iframe or auto-redirected, UI:P might be more appropriate, but the evidence supports active navigation.","SC:L and SI:L reflect the typical impact of reflected XSS limited to the current page context; a more severe impact (SC:H, SI:H) is possible if the XSS can exfiltrate full session credentials or perform privileged actions, but the patch evidence does not confirm the scope of available data.","The CAPEC-61 mapping is a broader parent pattern included for completeness; CAPEC-127 is the primary and most precise match."],"capecRationale":[{"capecId":"CAPEC-127","rationale":"The vulnerability is a reflected XSS: attacker-controlled input from the URL is reflected into the HTML response without encoding. CAPEC-127 is the most specific and directly applicable attack pattern. No uncertainty in this mapping."},{"capecId":"CAPEC-61","rationale":"CAPEC-61 is the broader parent pattern for XSS attacks. It is included as a secondary mapping to cover the general class of the vulnerability. CAPEC-127 is the more precise match; CAPEC-61 is listed for completeness."}],"commit":"23b879073eefce37e1065295d180c4bea7cef95f","confidence":"high","credits":[{"lang":"en","type":"reporter","value":"Jeroen Pinoy"},{"lang":"en","type":"remediation developer","value":"iglocska"},{"lang":"en","type":"remediation developer","value":"Claude Fable 5.1"}],"cvssRationale":"AV:N: The vulnerability is exploitable over the network via a crafted URL. AC:L: No race conditions or special environment conditions are required; the attacker simply crafts a URL with a malicious object_type value. AT:N: No manipulation of the attack target is needed. PR:L: The victim must be authenticated to MISP to reach the AnalystData view. UI:A: The victim must actively navigate to the attacker-supplied URL (e.g., click a link), which constitutes active user interaction. VC:N, VI:N, VA:N: The vulnerable MISP server itself is not directly compromised; the impact is on the victim's browser session. SC:L: The attacker can read data available in the victim's browser context (cookies, session tokens, page content) but impact is limited to the current page. SI:L: The attacker can modify the rendered page or submit forms on behalf of the victim within the session. SA:N: No broader security impact on other systems is expected from this reflected XSS.","fixSummary":"The fix introduces two layers of defense. First, the viewForObject action now validates the object_type parameter against the AnalystData::valid_targets whitelist and rejects any value not in that list with a NotFoundException, preventing arbitrary strings from reaching the view layer. Second, the two output sinks in the Overmind thread.ctp template now apply the h() HTML-encoding function to the object type before interpolation into translated strings, ensuring that even if a valid type were to contain special characters, it would be rendered as inert text rather than executable markup.","generatedAt":"2026-09-22T12:33:44.255419Z","generator":"patch2vuln.py","model":"qwen3.8:27b","modelComparison":{"rankings":[{"agreementScore":9,"assumptionCount":5,"confidence":"high","model":"qwen3.8:27b","score":6}],"selectedModel":"qwen3.8:27b","selectionMethod":"deterministic-consensus-v1","selectionNotice":"The selected result is closest to model consensus; this heuristic does not establish factual correctness and human review remains required."},"patchSha256":"4476bdd487c3b17c3cffff36a76763c107e8bf284095d61bd6860865ce8912e0","patchSummary":"In AnalystDataController.php, the patch adds an import of the AnalystData model and inserts a guard clause at the top of viewForObject that checks the $object_type parameter against AnalystData::valid_targets using a strict in_array comparison; if the value is not in the list, a NotFoundException is thrown. In thread.ctp, two occurrences of strtolower($objectType) passed directly into __() translation calls are wrapped with h() to HTML-encode the value before it is embedded in the rendered HTML output.","patchTruncated":false,"patches":[{"commit":"23b879073eefce37e1065295d180c4bea7cef95f","patchSha256":"4476bdd487c3b17c3cffff36a76763c107e8bf284095d61bd6860865ce8912e0","source":"https://github.com/MISP/MISP/commit/23b879073.patch","sourceUrl":"https://github.com/MISP/MISP/commit/23b879073.patch","subject":"fix: [security] Reflected XSS via the object type in the"}],"source":"https://github.com/MISP/MISP/commit/23b879073.patch","subject":"fix: [security] Reflected XSS via the object type in the","tagVersionBoundary":{"commits_after_fix":58,"repository":"https://github.com/MISP/MISP","tag":"v2.5.47","version":"2.5.47","version_type":"semver"},"weaknessRationale":[{"cweId":"CWE-79","rationale":"The object_type URL parameter is reflected into HTML output without encoding, allowing script injection. This is a textbook reflected XSS."},{"cweId":"CWE-116","rationale":"The view template interpolated the object type into translated strings without applying h() HTML encoding, which is the direct encoding failure that permits the XSS."},{"cweId":"CWE-20","rationale":"The controller accepted any arbitrary string as the object_type parameter without validating it against the known set of valid analyst-data target types, allowing attacker-controlled data to reach the output layer."}]}}},"recordType":"advisory","vulnId":"GCVE-1-2026-20234"}],"x_generator":{"engine":"Vulnogram 0.2.0"}}},"cveMetadata":{"assignerOrgId":"5a6e4751-2f3f-4070-9419-94fb35b644e8","assignerShortName":"CIRCL","cveId":"CVE-2026-95659","datePublished":"2026-09-22T12:40:38.097Z","dateReserved":"2026-09-22T12:40:33.071Z","dateUpdated":"2026-09-22T15:34:41.995Z","state":"PUBLISHED"},"dataType":"CVE_RECORD","dataVersion":"5.2"},"nvd":{"publishedDate":"2026-09-22 13:17:13","lastModifiedDate":"2026-09-22 16:18:19","problem_types":["CWE-20","CWE-79","CWE-116","CWE-79 CWE-79 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')","CWE-116 CWE-116 Improper Encoding or Escaping of Output","CWE-20 CWE-20 Improper Input Validation"],"metrics":{"cvssMetricV40":[{"source":"5a6e4751-2f3f-4070-9419-94fb35b644e8","type":"Secondary","cvssData":{"version":"4.0","vectorString":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:A/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","baseScore":4.8,"baseSeverity":"MEDIUM","attackVector":"NETWORK","attackComplexity":"LOW","attackRequirements":"NONE","privilegesRequired":"LOW","userInteraction":"ACTIVE","vulnConfidentialityImpact":"NONE","vulnIntegrityImpact":"NONE","vulnAvailabilityImpact":"NONE","subConfidentialityImpact":"LOW","subIntegrityImpact":"LOW","subAvailabilityImpact":"NONE","exploitMaturity":"NOT_DEFINED","confidentialityRequirement":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","availabilityRequirement":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","Safety":"NOT_DEFINED","Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","valueDensity":"NOT_DEFINED","vulnerabilityResponseEffort":"NOT_DEFINED","providerUrgency":"NOT_DEFINED"}}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-09-22T15:34:30.477077Z","id":"CVE-2026-95659","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"configurations":[]},"legacy_mitre":{"record":{"CveYear":"2026","CveId":"95659","Ordinal":"1","Title":"MISP Reflected XSS via Unvalidated Object Type in AnalystData Ov","CVE":"CVE-2026-95659","Year":"2026"},"notes":[{"CveYear":"2026","CveId":"95659","Ordinal":"1","NoteData":"MISP contains a reflected cross-site scripting (XSS) vulnerability in the AnalystDataController::viewForObject action. The method accepted a parent object type parameter from the URL without validation and passed it to the Overmind-themed AnalystData thread view element, where it was interpolated into two translated strings and rendered into the HTML response without output encoding. An authenticated attacker who can induce a victim to navigate to a crafted URL can inject arbitrary JavaScript that executes in the victim's browser within the MISP application context. This may allow the attacker to read session data, manipulate the page, or perform actions on behalf of the victim. \n\nThe vulnerability requires the victim to be authenticated to MISP and to actively visit the attacker-supplied URL. The affected component is the AnalystData controller and the Overmind theme's AnalystData thread element.\n\nVersion affected: <2.5.47","Type":"Description","Title":"MISP Reflected XSS via Unvalidated Object Type in AnalystData Ov"}]}}}