CVE-2026-103662

Executive Summary

CVE-2026-103662 is a reflected cross-site scripting (XSS) vulnerability in MISP's legacy taxonomy tag management confirmation forms — specifically the "add tag" and "disable tag" views. The affected forms echo a user-supplied tag name value from the HTTP request into the rendered HTML output without escaping, allowing an attacker who lures an authenticated site administrator to a crafted URL to execute arbitrary JavaScript in that administrator's browser session. The vulnerability affects MISP versions prior to 2.5.48; no public exploit, Nuclei template, or CISA KEV entry exists as of this report.

Technical Analysis

The vulnerability resides in the legacy taxonomy tag management confirmation flows of MISP (Malware Information Sharing Platform). Two confirmation forms are affected: the "add tag" form and the "disable tag" form. According to the NVD description, these forms "echoed a user-supplied tag name value from the request unescaped into the rendered HTML output."

The root cause is CWE-79 (Improper Neutralization of Input During Web Page Generation), specifically the reflected sub-type. In a reflected XSS scenario, the malicious input is not stored server-side; instead, it is immediately embedded into the HTTP response generated for a single request. The vulnerable code path fails to apply HTML entity encoding (or an equivalent output-encoding control) to the tag name parameter before interpolating it into the confirmation form's HTML body. As a result, any characters that have HTML metacharacter significance — such as <, >, ", ', and & — are interpreted by the browser as markup rather than as inert text.

Because the vulnerable views are administrative confirmation pages, exploitation requires that the request be processed within an authenticated administrator session. The attacker does not need to hold any MISP credentials; the attack relies on the administrator's existing authenticated session and the browser's automatic inclusion of session cookies with the crafted request.

The NVD description explicitly states that this is a "legacy" view, implying these confirmation forms may predate a newer, presumably safe implementation. This is a relevant risk factor: legacy code paths are frequently excluded from centralized output-encoding frameworks, template auto-escaping defaults, or security-focused refactoring efforts applied to modernized components.

No specific parameter name, route path, controller method, template file, or JavaScript sink is identified in the supplied data. Any such specifics would be speculative and are therefore omitted. The technical characterization is bounded to: (1) an HTTP request carrying a tag name value, (2) a server-side confirmation view that reflects that value into HTML without escaping, and (3) client-side script execution in the administrator's authenticated context.

Exploitation Scenarios

No public Proof-of-Concept is available for CVE-2026-103662. The attack chain described below is inferred strictly from the vulnerability class (reflected XSS) and the preconditions stated in the NVD description. No specific function names, endpoints, or parameters beyond those stated in the description are asserted.

1) Reconnaissance / Target Identification An attacker identifies internet-facing or internally reachable MISP instances. MISP deployments are frequently discoverable via search engines and Shodan using page-title or product fingerprints. The attacker then determines whether the instance runs a version below 2.5.48 and whether the legacy taxonomy tag confirmation views are enabled. Because the vulnerable code path is administrative, the attacker must also identify or assume the presence of an authenticated administrator who can be socially engineered.

2) Triggering the Flaw Class (Reflected XSS) The attacker constructs a URL that targets one of the legacy taxonomy tag management confirmation forms — the "add tag" or "disable tag" view — and appends a crafted tag name value containing HTML/JavaScript metacharacters. When this URL is visited by an authenticated administrator, the server reflects the tag name value directly into the confirmation form's HTML output without output encoding. The browser parses the injected markup as part of the page, and any embedded script executes in the origin of the MISP instance.

3) Payload / Execution Method (vulnerability-class level) At the class level, the payload is an HTML/JavaScript injection delivered via a request parameter that the application reflects unescaped. The precise syntax of a working payload depends on the injection context (element body, attribute value, or script block), which is not disclosed in the available data. What is known is that successful injection results in execution of arbitrary client-side script within the administrator's browser session on the MISP origin.

4) Post-Exploitation Impact Because execution occurs in the administrator's authenticated session and same-origin context, the attacker's script can read data accessible from the page, including session tokens, CSRF tokens, and any other sensitive material rendered or reachable from that page. This enables session hijacking, on-behalf-of actions, and privileged operations within the MISP interface. Refer to the Impact Assessment section for the corresponding CIA/scope implications.

Impact Assessment

The NVD description enumerates the following security impacts for successful exploitation:

• Execution of arbitrary client-side script in the context of the administrator's browser.
• Potential theft of session tokens, CSRF tokens, or other sensitive data accessible from the page.
• Potential for performing privileged actions on behalf of the administrator within the MISP interface.

Affected systems and blast radius. Any MISP instance below version 2.5.48 with the legacy taxonomy tag confirmation views enabled is potentially affected. Because MISP is a threat-intelligence sharing platform, a compromised administrator session is a high-value outcome: the account can typically access shared indicators, threat data, organizational configurations, and user management functions. The confidential impact is therefore elevated.

CVSS rationale. No CVSS score or vector is published for this CVE (CVSS Score: N/A, Vector: N/A). The vector provided in the METADATA block above is a class-appropriate construction based on the stated preconditions and should be treated as analytical, not authoritative. The rationale is: network-exploitable (AV:N), low attack complexity (AC:L), no privileges required by the attacker (PR:N, though an authenticated victim admin is required), user interaction required (UI:R, the admin must navigate to the crafted URL), scope changed (S:C, script executes in the MISP origin and can affect resources beyond the vulnerable component), high confidentiality impact (C:H, session and CSRF token theft, threat data exposure), and low integrity impact (I:L, privileged actions are possible but not guaranteed in every scenario). Availability impact is treated as none (A:N) since the description does not indicate a destructive or denial-of-service outcome.

EPSS. CVE-2026-103662 has not been scored by FIRST.org at the time of writing. No EPSS value is fabricated here.

Detection Guidance

Detection for reflected XSS is primarily achieved through web application logs and network inspection, supplemented by host-based detection of MISP process activity. Because the specific request parameter name for the tag name value is not disclosed in the available data, detection rules below use generic XSS-signature matching and generic access-log anomaly patterns rather than fabricated parameter names. Analysts are encouraged to enumerate the actual parameter name from their own MISP source deployment and tighten the rules accordingly.

Sigma Rule

title: MISP Legacy Taxonomy Tag Form Reflected XSS Attempt
id: 9f4c2a71-3b6d-4e2a-9c1f-7a8b5d0e2c11
status: experimental
description: Detects HTTP requests to MISP legacy taxonomy tag management confirmation views containing HTML/JavaScript metacharacters consistent with reflected XSS in CVE-2026-103662.
references:
  - https://nvd.nist.gov/vuln/detail/CVE-2026-103662
author: valtersit.com Threat Intelligence
date: 2026/01/01
tags:
  - attack.t1059.007
  - attack.initial_access
  - cve.2026-103662
logsource:
  category: webserver
detection:
  selection_method:
    cs-method:
      - GET
      - POST
  selection_path:
    cs-uri-stem|contains:
      - '/taxonomies'
      - '/tags'
  selection_payload:
    cs-uri-query|contains:
      - '<script'
      - '%3Cscript'
      - 'javascript:'
      - '%3Cimg'
      - 'onerror='
      - 'onload='
      - '%22%3E'
  condition: selection_method and selection_path and selection_payload
fields:
  - c-ip
  - cs-uri-stem
  - cs-uri-query
  - cs-username
  - sc-status
falsepositives:
  - Legitimate tag names containing angle brackets or encoded characters
  - Security scanners and fuzzers during authorized testing
level: high

YARA Rule

rule CVE_2026_103662_MISP_Reflected_XSS
{
    meta:
        description = "Detects reflected XSS payload patterns targeting MISP legacy taxonomy tag confirmation forms (CVE-2026-103662) in HTTP request captures or web logs"
        author = "valtersit.com Threat Intelligence"
        reference = "https://nvd.nist.gov/vuln/detail/CVE-2026-103662"
        date = "2026-01-01"
        severity = "high"

    strings:
        $tag_path1 = "/taxonomies" ascii nocase
        $tag_path2 = "/tags" ascii nocase
        $legacy     = "confirmation" ascii nocase

        $xss1 = "<script" ascii nocase
        $xss2 = "javascript:" ascii nocase
        $xss3 = "<img" ascii nocase
        $xss4 = "onerror=" ascii nocase
        $xss5 = "onload=" ascii nocase
        $xss6 = "%3Cscript" ascii nocase
        $xss7 = "document.cookie" ascii nocase
        $xss8 = "document.location" ascii nocase

    condition:
        (($tag_path1 or $tag_path2) or $legacy) and
        any of ($xss*)
}

Suricata IDS Rule

alert http any any -> any any (msg:"CVE-2026-103662 MISP Legacy Taxonomy Tag Form Reflected XSS Attempt";
  flow:established,to_server;
  http.method; content:"GET"; http.uri;
  content:"/taxonomies"; http.uri; nocase;
  content:"<script"; http.uri; nocase;
  classtype:web-application-attack;
  reference:url,nvd.nist.gov/vuln/detail/CVE-2026-103662;
  sid:2026103662; rev:1;)

alert http any any -> any any (msg:"CVE-2026-103662 MISP Legacy Taxonomy Tag Form Reflected XSS Attempt (URL-encoded)";
  flow:established,to_server;
  http.method; content:"GET"; http.uri;
  content:"/tags"; http.uri; nocase;
  content:"%3Cscript"; http.uri; nocase;
  classtype:web-application-attack;
  reference:url,nvd.nist.gov/vuln/detail/CVE-2026-103662;
  sid:2026103663; rev:1;)

Elastic Detection

sequence by source.ip with maxspan=1m
  [network where url.path like~ ("*/taxonomies*", "*/tags*") and
   network.protocol == "http" and
   (url.query like~ "*<script*" or
    url.query like~ "*%3Cscript*" or
    url.query like~ "*javascript:*" or
    url.query like~ "*onerror=*" or
    url.query like~ "*onload=*")]

Splunk SPL Query

index=web sourcetype=access_combined OR sourcetype=misp:web
  (uri_path="*/taxonomies*" OR uri_path="*/tags*")
  (uri_query="*<script*" OR uri_query="*%3Cscript*" OR uri_query="*javascript:*"
   OR uri_query="*onerror=*" OR uri_query="*onload=*" OR uri_query="*%3Cimg*")
| eval attack_indicator=case(
    match(uri_query,"(?i)<script|%3Cscript"), "script_tag_injection",
    match(uri_query,"(?i)javascript:"), "javascript_scheme",
    match(uri_query,"(?i)onerror=|onload="), "event_handler_injection",
    1=1, "other_xss_indicator")
| stats count min(_time) as first_seen max(_time) as last_seen
        values(clientip) as src_ips
        values(uri_path) as paths
  by attack_indicator
| where count >= 1
| sort - count

Wazuh OSSEC Rule

<group name="web,misp,cve-2026-103662,">
  <rule id="20261036" level="10">
    <if_sid>31100</if_sid>
    <match>(?i)(/taxonomies|/tags)</match>
    <match>(?i)(&lt;script|%3Cscript|javascript:|onerror=|onload=|%3Cimg)</match>
    <description>CVE-2026-103662: Possible reflected XSS attempt against MISP legacy taxonomy tag confirmation forms</description>
    <mitre>
      <id>T1059.007</id>
    </mitre>
    <group>web_attack,xss,</group>
  </rule>

  <rule id="20261037" level="12">
    <if_sid>20261036</if_sid>
    <match>(?i)(document.cookie|document.location|fetch\(|XMLHttpRequest)</match>
    <description>CVE-2026-103662: High-confidence XSS payload targeting MISP admin session</description>
    <mitre>
      <id>T1059.007</id>
    </mitre>
    <group>web_attack,xss,</group>
  </rule>
</group>

Mitigation & Patch Guidance

Patch confidence: 0/4 (UNPATCHED — no patch evidence from any tracked source). No vendor advisory, commit reference, or release artifact has been confirmed by tracked sources. The published affected-version range states "<2.5.48," which implies version 2.5.48 is the resolving release; however, this report does not assert that 2.5.48 contains a fix, because no patch source was provided. Administrators should verify with the upstream MISP project or their distribution channel before treating any specific version as remediated.

1) Immediate mitigations

• Validate whether your MISP deployment relies on the legacy taxonomy tag management confirmation views. If they are unused in your environment, disable or deprecate them at the application configuration level to remove the attack surface entirely.
• Place the MISP administrative interface behind an authentication gateway, VPN, or IP allowlist to reduce the population of reachable admins who could be socially engineered.
• Deploy the Sigma, Suricata, and web-server detection rules above to identify and block inbound requests carrying XSS metacharacters to the taxonomy/tag paths.
• Enforce a Content-Security-Policy on the MISP administrative interface that disallows inline script execution (script-src 'self' plus nonce/hash where feasible) to blunt the impact of any reflected injection.
• Restrict and monitor administrator outbound link-clicking by training admins on phishing links targeting internal application URLs.

2) Patch / upgrade steps

• Monitor the upstream MISP release notes and advisory channels for confirmation of a fix version. The affected-version range indicates remediation at or after 2.5.48, but no patch evidence was confirmed in tracked sources (patch confidence 0/4).
• When a confirmed release is available, upgrade MISP in a staged manner and validate that the legacy taxonomy tag confirmation views either apply output encoding or have been replaced by the modernized views.
• If upgrading immediately is not feasible, prioritize the application-level mitigations in step 1.

3) Long-term hardening

• Eliminate legacy template and controller code paths that bypass the application's centralized output-encoding or auto-escaping framework. Audit the MISP codebase for other legacy administrative views that reflect request parameters.
• Adopt a templating engine configuration with auto-escaping enabled by default and treat any explicit "raw/unescaped" output as a security-review trigger.
• Implement a standing SAST/DAST pipeline that includes reflected-XSS fuzzing against administrative endpoints.
• Enforce role-based access and least privilege for MISP administrative accounts; reduce the number of users holding site-admin rights.
• Log, retain, and alert on administrator access to confirmation views combined with anomalous query strings, using the detection content provided above.

References

• NIST National Vulnerability Database — CVE-2026-103662: https://nvd.nist.gov/vuln/detail/CVE-2026-103662
• MITRE CWE-79 — Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting'): https://cwe.mitre.org/data/definitions/79.html
• MITRE ATT&CK T1059.007 — Command and Scripting Interpreter: JavaScript: https://attack.mitre.org/techniques/T1059/007/
• OWASP Cross Site Scripting Prevention Cheat Sheet: https://cheatsheetseries.owasp.org/cheatsheets/Cross_Site_Scripting_Prevention_Cheat_Sheet.html
• CISA Known Exploited Vulnerabilities Catalog (CVE-2026-103662 not listed as of this report): https://www.cisa.gov/known-exploited-vulnerabilities-catalog

No public Proof-of-Concept, Nuclei template, or exploit code is available for CVE-2026-103662. No exploit-in-the-wild evidence or threat-actor campaign attribution was identified in the provided data or tracked sources. CVE-2026-103662 is not listed in the CISA KEV catalog.