CVE-2026-104900

Executive Summary

CVE-2026-104900 is a stored cross-site scripting (XSS) vulnerability in MISP, an open-source threat intelligence and threat-sharing platform. The flaw resides in the index table rendering of the remote event preview, where a count field template escapes the associated link URL but renders the field value without HTML encoding. An attacker with the ability to create or modify events on a linked (remote) MISP server can embed HTML or JavaScript markup in an event identifier, which executes in the session of any local user who views the remote event preview index. Versions below 2.5.48 are affected, and no patch evidence exists from any tracked source.

Technical Analysis

The vulnerability is a classic stored (persistent) cross-site scripting condition, classified under CWE-79. The affected surface is the index table rendering path that MISP uses to display events pulled from a linked remote MISP server ("remote event preview"). Within that rendering logic, a template associated with a count field performs output encoding on a linked URL but fails to HTML-encode the corresponding field value itself. This asymmetry is the root cause: one value in the template is safely escaped while the sibling value is written into the HTML response as raw content.

Because the unescaped value is derived from a remote event attribute — specifically an event identifier that a remote user can create or modify — the injection is persistent. Once the crafted identifier exists on the linked server and is synchronized or previewed on the local instance, the malicious markup becomes part of the local page's DOM every time the remote event preview index is rendered. There is no need for a victim to click a crafted link containing the payload; viewing the index is sufficient.

The attack surface is the web application front end of a local MISP deployment that has at least one configured remote MISP server connection. The attacker's initial foothold is not on the victim's instance at all — it is on the linked server, where they only need privileges sufficient to create or modify an event. This makes the vulnerability a cross-instance trust-boundary issue: the local instance implicitly trusts event content originating from a federated peer and renders part of it without appropriate contextual output encoding.

Two distinct control failures are relevant. First, the missing HTML encoding on the field value permits the browser to interpret attacker-controlled text as markup. Second, the template's inconsistent treatment of sibling values (escaping the URL but not the value) indicates the encoding was applied narrowly and by hand rather than systematically at the sink. The description does not name the specific template file, function, class, or parameter, and none are fabricated here; the analysis is limited to what the NVD description establishes.

No public proof-of-concept, exploit code, or Nuclei template is available. No CVSS score or vector is assigned in the provided intelligence, and no EPSS score has been published by FIRST.org. Because the CNA title is blank and the vendor/product fields are unknown in the source record, the vendor attribution "MISP" and the affected range "<2.5.48" are taken from the NVD description text itself.

Exploitation Scenarios

The attack chain for CVE-2026-104900, inferred strictly from the stated vulnerability class and preconditions, proceeds as follows:

1. Reconnaissance and target identification. The attacker identifies MISP deployments that participate in threat-intelligence sharing and are likely to have remote MISP server connections configured — particularly federated or community-sharing instances. The attacker's first requirement is not access to the victim's instance but the ability to reach a MISP server that is linked to the victim. This can be satisfied by operating an account on a shared community instance, by controlling a federated peer, or by compromising an existing trusted peer.

2. Triggering the flaw class. With sufficient access on the linked server to create or modify an event, the attacker crafts an event identifier containing HTML or JavaScript markup. The payload is stored server-side on the linked instance. Because the flaw is a stored XSS in the remote event preview index, nothing further is required from the attacker at this stage — the payload simply has to be present in a field that the local instance will render in the preview index.

3. Payload and execution. On the local MISP instance, the remote event preview index renders the crafted value without HTML encoding. When an authenticated local user opens that index view, the browser parses the injected markup and executes the embedded script in the origin of the MISP web application. No user interaction beyond viewing the page is needed; the description does not specify any additional click or navigation requirement.

4. Post-exploitation impact. Successful execution yields arbitrary JavaScript in the context of the MISP web application, running inside the victim's authenticated session. The description enumerates session hijacking, data exfiltration, and unauthorized actions performed on behalf of the authenticated user as the potential consequences. For a threat-intelligence platform, this is a high-value target: a hijacked session may expose event data, attributes, correlations, and potentially the ability to act within the platform under the victim's identity.

No public PoC is available; the chain above is derived from the vulnerability class and the stated preconditions rather than from observed exploit code. The description does not disclose the exact attack string, the template, or the synchronization mechanism by which the crafted identifier reaches the local instance, and none of these are assumed here.

Impact Assessment

The principal impact is arbitrary JavaScript execution in the origin of the MISP web application, delivered to authenticated users who view the remote event preview index. Because the script runs in the victim's session, an attacker can potentially hijack the session, exfiltrate data visible to that user, or perform actions as that user. On a platform that aggregates threat intelligence, this can expose sensitive reporting, indicators, and sharing relationships, and it can undermine the integrity of the intelligence stored and redistributed by the instance.

Blast radius is defined by which local users view the affected preview index. Any authenticated user with access to that view is a potential victim, and the injection persists until the malicious remote event identifier is removed or the rendering logic is corrected — distinguishing this from reflected XSS, which requires a per-victim lure.

Subscore reasoning (based on the synthesized vector CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N, offered as the analyst-derived vector since no official score was provided): network attack vector (AV:N) because the malicious content is delivered over the web interface; low attack complexity (AC:L) since no special conditions beyond a linked server are required; low privileges (PR:L) because the attacker needs only rights to create or modify events on a linked instance; user interaction (UI:R) because a victim must view the preview index; changed scope (S:C) because script execution escapes the rendered data into the browser context of the application; and low confidentiality, integrity, and availability impacts (C:L/I:L/A:N) consistent with a client-side script execution condition. Note: no official CVSS score or vector is available; the string above is the analyst-derived assessment, not a vendor-published value.

Detection Guidance

Sigma Rule

title: Suspicious HTML/JavaScript Markup in MISP Remote Event Identifier
id: 3f6b9c2e-0d41-4a7e-9c88-mispxss104900
status: experimental
description: Detects stored XSS payloads (CVE-2026-104900) in MISP event identifiers originating from linked remote servers, where the remote event preview index renders the value without HTML encoding.
references:
  - https://nvd.nist.gov/vuln/detail/CVE-2026-104900
author: valtersit.com
date: 2026/01/01
logsource:
  product: misp
  service: web
detection:
  selection_keywords:
    - '<script'
    - 'javascript:'
    - 'onerror='
    - 'onload='
    - '<img'
    - '<svg'
    - '<iframe'
    - 'document.cookie'
  selection_context:
    - 'remote'
    - 'preview'
    - 'event'
    - 'identifier'
  condition: selection_keywords and selection_context
falsepositives:
  - Legitimate event identifiers that describe XSS in threat-intel feeds
  - Security research events that intentionally contain HTML samples
level: high
tags:
  - attack.t1059.007
  - cwe.79

YARA Rule

rule CVE_2026_104900_MISP_Stored_XSS_Identifier
{
    meta:
        description = "Detects HTML/JavaScript XSS markup in MISP event identifiers linked to CVE-2026-104900 remote event preview stored XSS"
        author = "valtersit.com"
        reference = "https://nvd.nist.gov/vuln/detail/CVE-2026-104900"
        date = "2026-01-01"
        severity = "high"
    strings:
        $xss1 = "<script" nocase ascii wide
        $xss2 = "</script>" nocase ascii wide
        $xss3 = "javascript:" nocase ascii wide
        $xss4 = "onerror=" nocase ascii wide
        $xss5 = "onload=" nocase ascii wide
        $xss6 = "<svg" nocase ascii wide
        $xss7 = "<iframe" nocase ascii wide
        $cookie = "document.cookie" nocase ascii wide
        $ident = "identifier" nocase ascii wide
    condition:
        filesize < 2MB and
        (any of ($xss1,$xss2,$xss3,$xss4,$xss5,$xss6,$xss7)) and
        ($cookie or $ident)
}

Suricata IDS Rule

alert http any any -> any any (msg:"CVE-2026-104900 MISP stored XSS - HTML/JS markup in remote event identifier"; flow:established,to_server; http.method; content:"POST"; http.uri; content:"events"; nocase; http.request_body; content:"identifier"; nocase; pcre:"/(<script|javascript:|onerror=|onload=|<svg|<iframe)/iR"; reference:cve,2026-104900; reference:url,nvd.nist.gov/vuln/detail/CVE-2026-104900; classtype:web-application-attack; sid:2026104900; rev:1;)

Elastic Detection

sequence by host.id, user.name with maxspan=5m
  [ network where event.category == "network" and
      network.protocol == "http" and
      http.request.method == "POST" and
      stringContains(http.request.body, "identifier") and
      (stringContains(http.request.body, "<script") or
       stringContains(http.request.body, "javascript:") or
       stringContains(http.request.body, "onerror=") or
       stringContains(http.request.body, "onload=")) ]
  [ network where event.category == "web" and
      stringContains(url.path, "remote") and
      stringContains(url.path, "preview") ]

Splunk SPL Query

index=web sourcetype=misp* OR sourcetype=proxy
(http.method=POST AND uri_path="*events*" AND form_data="*identifier*")
OR (uri_path="*remote*" AND uri_path="*preview*")
| eval xss_hit=if(match(form_data,"(?i)(<script|javascript:|onerror=|onload=|<svg|<iframe)"),"MATCH","")
| where xss_hit="MATCH" OR match(form_data,"(?i)(<script|javascript:|onerror=|onload=)")
| stats count min(_time) as first_seen max(_time) as last_seen values(src_ip) as source_ips values(user) as users by uri_path, xss_hit
| convert ctime(first_seen) ctime(last_seen)
| sort - count

Wazuh OSSEC Rule

<group name="misp,web,xss,">
  <rule id="104900" level="12">
    <decoded_as>web-accesslog</decoded_as>
    <if_sid>31100</if_sid>
    <url>events|remote|preview</url>
    <regex>(?i)(%3Cscript|javascript%3A|onerror%3D|onload%3D|%3Csvg|%3Ciframe|&lt;script)</regex>
    <description>CVE-2026-104900: Possible MISP stored XSS payload in remote event identifier (HTML/JS markup detected)</description>
    <mitre>
      <id>T1059.007</id>
    </mitre>
    <group>cve_2026_104900,</group>
  </rule>
</group>

Mitigation & Patch Guidance

Patch confidence: 0/4 (UNPATCHED — no patch evidence from any tracked source). No vendor fix, workaround, or affected-version artifact list is available; the affected range per the description is versions below 2.5.48.

1. Immediate mitigations:

• Restrict and review linked/remote MISP server connections. Removing or disabling unnecessary federated peers eliminates the vector for untrusted event identifiers reaching the local instance. Apply least-privilege to which remote peers can push events.
• Treat remote event content as untrusted. Until the rendering sink is corrected, avoid or limit access to the remote event preview index, or restrict it to a small set of trusted administrators.
• Deploy a Content Security Policy (CSP) that disallows inline script and restricts script sources. A strict CSP is an effective compensating control against stored XSS execution even when output encoding fails.
• Enable HTTP-only and Secure cookie attributes for session cookies to limit session theft via client-side script, and enable continuous re-authentication or short session lifetimes for privileged MISP accounts.
• Detect and purge existing malicious payloads: audit remote-linked events for identifiers containing HTML or JavaScript markup and remove/quarantine them.

2. Patch/upgrade steps:

• Monitor the MISP project’s official release channels and repository for a version at or above 2.5.48 that addresses the remote event preview index rendering. Verify the fix corrects the output-encoding asymmetry (URL escaped, field value rendered raw) before relying on it.
• Once a fixed release is available, stage it in a test instance with representative remote connections, confirm the preview index correctly encodes field values, and then roll out to production. Rotate session secrets and review MISP audit logs after upgrading because exploitation may have occurred before the fix.

3. Long-term hardening:

• Adopt systematic, context-aware output encoding at every rendering sink rather than ad hoc per-value escaping; require that sibling values in the same template share the same encoding policy.
• Add automated template linting/tests that fail builds when unescaped user- or peer-controlled data reaches HTML output.
• Enforce content sanitization for federated event data at ingestion so markup cannot persist into local data stores.
• Maintain an inventory of remote MISP connections with owners, purpose, and data-integrity expectations, and re-review on a schedule.

References

• NVD — CVE-2026-104900: https://nvd.nist.gov/vuln/detail/CVE-2026-104900
• MISP Project — official repository and release notes (verify version 2.5.48+ for the fix): https://github.com/MISP/MISP
• MISP Project documentation — remote/linked server and federation sharing configuration: https://misp-project.org/
• OWASP — Cross Site Scripting Prevention Cheat Sheet (context-aware output encoding guidance): https://cheatsheetseries.owasp.org/cheatsheets/Cross_Site_Scripting_Prevention_Cheat_Sheet.html
• MITRE ATT&CK — T1059.007 Command and Scripting Interpreter: JavaScript: https://attack.mitre.org/techniques/T1059/007/

No CISA KEV listing, no public proof-of-concept, no exploit code, and no Nuclei template are associated with this CVE as of this report. No known threat actor campaign or exploit-in-the-wild evidence is available in the provided intelligence.