CVE-2026-103664

Executive Summary

CVE-2026-103664 is a reflected cross-site scripting (XSS) vulnerability in MISP, an open-source threat intelligence and information sharing platform, affecting the analyst data notes panel. The flaw allows a user-supplied "seed" value passed in the URL path to be rendered directly into inline JavaScript within the HTML response without sanitization or type enforcement. A remote attacker who can lure an authenticated MISP user into visiting a crafted URL (e.g., via phishing) can execute arbitrary JavaScript in the victim's browser, potentially stealing session tokens, manipulating the interface, or acting on the victim's behalf.

Technical Analysis

MISP (Malware Information Sharing Platform) is widely deployed by SOCs, CERTs, and threat intelligence teams for storing, correlating, and sharing indicators of compromise (IOCs). The analyst data notes panel is an authenticated application view used by analysts to annotate attributes or objects during investigation workflows.

The vulnerability class is reflected cross-site scripting (CWE-79). According to the description, the seed path parameter — supplied by the user via the URL — was passed directly into inline JavaScript within the rendered HTML response without any sanitization or type enforcement. This means an attacker-controlled value in the URL path is reflected into a script context in the response body rather than an HTML text context, which is significant: script-context injection typically bypasses HTML-entity encoding defenses and makes payload construction straightforward.

Two distinct failures converge to create the vulnerability:

1. Insufficient input handling (CWE-79): The seed value was not validated, sanitized, or type-constrained before being embedded in the response. Because the value is placed inside inline JavaScript, the attacker controls JavaScript syntax rather than merely markup.

2. Context-inappropriate output encoding: Even where output encoding exists at the application layer, placing user input into a JavaScript context without JavaScript-specific escaping (or a safe serialization method such as JSON encoding) leaves the injection point intact.

Attack surface: The endpoint is reachable over the network and is part of the authenticated analyst data view for an attribute or object. Exploitation requires interaction (the victim must be authenticated and must navigate to the crafted URL), which is characteristic of reflected XSS. The "seed path parameter" naming indicates the value is carried in the URL path segment rather than a query string, which can affect caching, logging, and WAF detection behavior — path-segment payloads are frequently missed by signature sets focused on query parameters.

No public proof-of-concept, Nuclei template, or exploit code is known at the time of writing. The exact parameter name, endpoint path, and payload syntax are not disclosed in the available advisory data, so implementation-level reproduction details cannot be specified here. All technical claims in this report are bounded by the NVD description.

Exploitation Scenarios

No public PoC is available; the following attack chain is inferred from the vulnerability class (reflected XSS in a JavaScript context) and the stated preconditions.

1. Reconnaissance / target identification. The attacker identifies an organization using MISP as its threat-sharing platform. This can be done through OSINT (job postings, public MISP instances, shared intelligence feeds, certificate transparency for MISP-branded hosts) or by targeting known analyst contacts. The attacker does not need MISP credentials; only the victim does.

2. Triggering the flaw. The attacker constructs a URL that places a crafted value in the seed path parameter of the analyst data view for an attribute or object. Because the value flows unsanitized into inline JavaScript, the attacker shapes the payload for a script context — for example, breaking out of any surrounding JavaScript string or expression and appending arbitrary script. The attacker then delivers the URL to an authenticated MISP analyst via phishing email, chat, a shared ticket, or a social-engineering lure.

3. Payload execution. When the victim clicks the link while authenticated, MISP renders the analyst data notes panel and reflects the seed value into the inline JavaScript in the HTML response. The victim's browser executes the injected JavaScript in the origin of the MISP instance. No server-side command execution or authentication bypass occurs; the code runs with the victim's privileges.

4. Post-exploitation impact. With script execution in the authenticated session, the attacker can read session tokens and any sensitive data visible in the page, manipulate the rendered analyst data interface (for example, to hide or falsify annotations), and perform actions on behalf of the victim — such as reading, modifying, or exfiltrating threat intelligence data the victim is authorized to access. Because MISP is a shared intelligence platform, a compromised analyst session can cascade into downstream data exposure for partner organizations.

Note: The description asserts the above impact. Specific endpoints, exact payload strings, and exfiltration channels are not disclosed in the available data and are not fabricated here.

Impact Assessment

Confidentiality: Limited-to-moderate. Session tokens and page-visible sensitive data (attribute details, analyst notes, possibly API keys displayed in the UI) are at risk. CVSS scope change means impact can extend beyond the vulnerable component.

Integrity: Limited-to-moderate. The attacker can manipulate the analyst data interface and perform actions as the victim, including modifying annotations or triggering platform operations available to the victim.

Availability: None asserted by the vulnerability description.

Blast radius. The vulnerable component is the MISP web application; exploitation requires an authenticated victim and user interaction, so mass unauthenticated exploitation is not possible. However, MISP instances are typically deployed to support an entire SOC or national CERT, and compromised analyst sessions can expose shared threat intelligence, partner data, and operational context. A single successful phish against a high-privilege analyst (e.g., an administrator) significantly increases impact.

CVSS rationale (informational). Official CVSS metadata is not published (N/A). The vector provided in METADATA (AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N) is consistent with a reflected XSS requiring victim interaction with scope change, but until an authoritative score is published, treat ratings as provisional.

Exploitation likelihood. EPSS has not been assigned by FIRST.org; do not infer a probability. No CISA KEV listing, no public exploit, and no exploit code are known. The low barrier to crafting a reflected XSS URL means exploitation is plausible once the exact parameter behavior is understood, but there is no observed in-the-wild exploitation at the time of writing.

Detection Guidance

Detection should focus on malicious payloads in URL paths reaching MISP endpoints, anomalous JavaScript-string breakout patterns in requests, and XSS-pattern activity in web server and WAF telemetry.

Sigma Rule

title: Potential Reflected XSS in MISP Analyst Data Notes (CVE-2026-103664)
id: 9f4c2a71-6b1e-4c8d-9e02-7a5d3c1f8b04
status: experimental
description: Detects suspicious script-context payload patterns in HTTP requests targeting MISP web endpoints, consistent with reflected XSS via a URL path parameter.
references:
  - https://nvd.nist.gov/vuln/detail/CVE-2026-103664
author: Threat Intelligence Team
date: 2026-01-01
tags:
  - attack.t1190
  - attack.initial_access
logsource:
  category: webserver
detection:
  selection_method:
    cs-method:
      - 'GET'
  selection_misp:
    cs-uri-stem|contains:
      - '/analystData'
      - '/analyst_data'
      - '/attributes'
      - '/objects'
  selection_payload:
    cs-uri-query|contains:
      - '<script'
      - 'javascript:'
      - 'onerror='
      - 'onload='
      - 'document.cookie'
      - 'alert('
      - 'String.fromCharCode'
      - '%3Cscript'
      - '%3C%2Fscript%3E'
  condition: selection_method and selection_misp and selection_payload
fields:
  - c-ip
  - cs-uri-stem
  - cs-uri-query
  - cs-user-agent
falsepositives:
  - Security scanners and authorized penetration tests
  - Legitimate analyst activity containing encoded strings
level: medium

YARA Rule

rule CVE_2026_103664_MISP_Reflected_XSS
{
    meta:
        description = "Detects reflected XSS payload patterns targeting MISP analyst data notes panel (CVE-2026-103664)"
        reference = "https://nvd.nist.gov/vuln/detail/CVE-2026-103664"
        author = "Threat Intelligence Team"
        date = "2026-01-01"
        severity = "medium"

    strings:
        $misp_ctx1 = "analystData" ascii nocase
        $misp_ctx2 = "analyst_data" ascii nocase
        $misp_ctx3 = "seed" ascii nocase

        $xss1 = "<script>" ascii nocase
        $xss2 = "</script>" ascii nocase
        $xss3 = "javascript:" ascii nocase
        $xss4 = "onerror=" ascii nocase
        $xss5 = "onload=" ascii nocase
        $xss6 = "document.cookie" ascii nocase
        $xss7 = "String.fromCharCode" ascii nocase
        $xss8 = "eval(" ascii nocase
        $xss9 = "fetch(" ascii nocase
        $xss10 = "XMLHttpRequest" ascii nocase

        $enc1 = "%3Cscript" ascii nocase
        $enc2 = "%3C%2Fscript%3E" ascii nocase
        $enc3 = "&#x3c;script" ascii nocase

    condition:
        (any of ($misp_ctx*)) and
        (2 of ($xss*) or any of ($enc*))
}

Suricata IDS Rule

alert http any any -> any any (msg:"CVE-2026-103664 MISP Analyst Data Notes Reflected XSS Attempt"; flow:established,to_server; http.method; content:"GET"; http.uri; content:"script"; nocase; http.uri; content:"<"; http.uri; content:"document.cookie"; nocase; threshold:type limit, track by_src, count 5, seconds 60; reference:cve,2026-103664; reference:url,nvd.nist.gov/vuln/detail/CVE-2026-103664; classtype:web-application-attack; sid:2026103664; rev:1;)

alert http any any -> any any (msg:"CVE-2026-103664 MISP Reflected XSS - JavaScript Context Breakout"; flow:established,to_server; http.method; content:"GET"; http.uri; content:"%3Cscript" nocase; http.uri; content:"onerror" nocase; threshold:type limit, track by_src, count 5, seconds 60; reference:cve,2026-103664; classtype:web-application-attack; sid:2026103665; rev:1;)

Elastic Detection

sequence by source.ip with maxspan=2m
  [ network where network.protocol == "http" and http.request.method == "GET"
    and (url.path : ("*analystData*" or "*analyst_data*" or "*attributes*" or "*objects*")) ]
  [ network where network.protocol == "http" and http.request.method == "GET"
    and http.request.uri : ("*<script*" or "*%3Cscript*" or "*onerror=*" or "*document.cookie*"
                             or "*javascript:*" or "*String.fromCharCode*") ]

Splunk SPL Query

index=web sourcetype=access_combined OR sourcetype=nginx:access OR sourcetype=apache:access
(method=GET uri_path=*analystData* OR uri_path=*analyst_data* OR uri_path=*attributes* OR uri_path=*objects*)
(uri=*"<script"* OR uri=*"%3Cscript"* OR uri=*"onerror="* OR uri=*"document.cookie"* OR uri=*"javascript:"* OR uri=*"String.fromCharCode"* OR uri=*"onload="*)
| eval risk=case(
    match(uri, "(?i)document\.cookie"), "high",
    match(uri, "(?i)<script|%3Cscript"), "high",
    match(uri, "(?i)onerror=|onload="), "medium",
    1=1, "low")
| stats count min(_time) as first_seen max(_time) as last_seen values(uri) as uris by src_ip, uri_path, risk, status
| where count > 0
| sort - count

Wazuh OSSEC Rule

<group name="web,misp,xss,">
  <rule id="100664" level="8">
    <if_sid>31100,31101,31103,31104</if_sid>
    <url>analystData|analyst_data|attributes|objects</url>
    <regex type="pcre2">(&lt;script|%3Cscript|onerror=|onload=|document\.cookie|javascript:|String\.fromCharCode)</regex>
    <description>CVE-2026-103664: Possible reflected XSS attempt against MISP analyst data notes panel (script-context payload in URL).</description>
    <mitre>
      <id>T1190</id>
    </mitre>
    <group>attack,web_app_attack,</group>
  </rule>

  <rule id="100665" level="10" frequency="5" timeframe="60">
    <if_matched_sid>100664</if_matched_sid>
    <same_source_ip />
    <description>CVE-2026-103664: Repeated reflected XSS attempts against MISP from same source (possible automated exploit scanning).</description>
    <group>attack,web_app_attack,</group>
  </rule>
</group>

Mitigation & Patch Guidance

Patch confidence: 0/4 (UNPATCHED — no patch evidence from any tracked source).

1. Immediate mitigations (apply now).

   • Apply input validation and output encoding at the application layer only if you control a fork: treat the seed path parameter as a strictly typed value, and encode it with context-appropriate JavaScript escaping (or serialize as JSON) before embedding in the response. Do not rely on HTML-entity encoding alone for a script context.
   • Deploy/extend WAF rules to inspect URL path segments (not only query strings) for script-context payload patterns: <script, javascript:, onerror=, onload=, document.cookie, String.fromCharCode.
   • Restrict MISP administrative interfaces to trusted networks or VPN where operationally feasible, reducing the phishing-reachable attack surface.
   • Harden session handling: set HttpOnly and Secure flags on session cookies, enforce SameSite=Strict or Lax, and shorten session lifetimes to limit the value of a stolen token.
   • Deploy a strict Content-Security-Policy that eliminates inline script execution (script-src without 'unsafe-inline', using nonces or hashes). This is a high-value compensating control against XSS in a JavaScript context.

2. Patch/upgrade steps.

   • The advisory references commit 58925dbf0 (post v2.5.48). Track the MISP project repository and upgrade to the first release that includes this commit as soon as it is published by the maintainers.
   • Because no tracked patch source currently confirms a released fixed version, verify the commit's presence in your build before claiming remediation, and monitor the MISP GitHub releases and security advisories for an official version tag.
   • Until a tagged release is available, treat this CVE as unpatched for planning purposes and rely on the compensating controls above.

3. Long-term hardening.

   • Adopt a secure development standard requiring context-aware output encoding for every dynamic value rendered into HTML, JavaScript, CSS, and URL contexts, with automated static analysis checks in CI.
   • Enforce a Content-Security-Policy with nonce/hash-based script-src as a baseline across all analyst-facing applications.
   • Segment MISP deployment behind an authenticated reverse proxy or zero-trust access layer; enable phishing-resistant MFA for all analyst accounts.
   • Monitor threat-sharing channels and the MISP project for official advisories and version tags; re-evaluate patch confidence when a fixed release is published.

References

• NVD — CVE-2026-103664: https://nvd.nist.gov/vuln/detail/CVE-2026-103664
• MITRE CWE-79 — Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting'): https://cwe.mitre.org/data/definitions/79.html
• MISP Project repository — commit 58925dbf0 (referenced fix; verify presence in your build): https://github.com/MISP/MISP
• OWASP — Cross Site Scripting Prevention Cheat Sheet: https://cheatsheetseries.owasp.org/cheatsheets/Cross_Site_Scripting_Prevention_Cheat_Sheet.html
• CISA Known Exploited Vulnerabilities Catalog (check for addition; not currently listed as of this report): https://www.cisa.gov/known-exploited-vulnerabilities-catalog

No threat actor campaigns or exploit-in-the-wild evidence are known at the time of writing. No public PoC, Nuclei template, or exploit code has been observed. EPSS has not been assigned by FIRST.org.