{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-95665", "assignerOrgId": "5a6e4751-2f3f-4070-9419-94fb35b644e8", "state": "PUBLISHED", "assignerShortName": "CIRCL", "dateReserved": "2026-09-22T13:01:42.885Z", "datePublished": "2026-09-22T13:01:45.225Z", "dateUpdated": "2026-09-22T15:33:05.484Z"}, "containers": {"cna": {"affected": [{"modules": ["Events export confirmation form (app/View/Events/ajax/eventRestSearchExportConfirmationForm.ctp)", "Default theme", "UiBeta theme"], "product": "MISP", "programFiles": ["app/View/Events/ajax/eventRestSearchExportConfirmationForm.ctp"], "repo": "https://github.com/MISP/MISP", "vendor": "MISP", "versions": [{"lessThan": "2.5.47", "status": "affected", "version": "0", "versionType": "semver"}]}], "credits": [{"lang": "en", "type": "reporter", "value": "Niels Teusink of Eye Security"}, {"lang": "en", "type": "remediation developer", "value": "iglocska"}, {"lang": "en", "type": "remediation developer", "value": "Claude Opus 5 (1M context)"}], "descriptions": [{"lang": "en", "supportingMedia": [{"base64": false, "type": "text/html", "value": "<p>MISP contains a reflected cross-site scripting (XSS) vulnerability in the event REST search export confirmation form. The view template app/View/Events/ajax/eventRestSearchExportConfirmationForm.ctp renders a URL-supplied event ID list into a single-quoted JavaScript string literal using PHP's json_encode() without any hex-encoding flags. By default, json_encode() escapes double quotes and backslashes but does not escape single quotes. Because the JavaScript string is delimited by single quotes, an attacker can inject a single-quote character to terminate the string literal and execute arbitrary JavaScript in the victim's browser session.</p><p>The vulnerability affects the Default and UiBeta themes, both of which render this view. The Overmind theme's own copy of the form already passed the value through an escaped data attribute and was not affected by this specific sink.</p><p>Preconditions: the victim must be an authenticated MISP user and must actively open or navigate to the attacker-crafted URL. The attacker does not require an account or any prior access to the MISP instance.</p><p>Security impact: successful exploitation allows execution of arbitrary JavaScript in the context of the MISP web application, potentially leading to session hijacking, unauthorized actions performed on behalf of the victim, exfiltration of sensitive data visible in the session, or further client-side attacks. The vulnerable component's own confidentiality, integrity, and availability are not directly compromised; the impact is on the underlying user session.</p>"}], "value": "MISP contains a reflected cross-site scripting (XSS) vulnerability in the event REST search export confirmation form. The view template app/View/Events/ajax/eventRestSearchExportConfirmationForm.ctp renders a URL-supplied event ID list into a single-quoted JavaScript string literal using PHP's json_encode() without any hex-encoding flags. By default, json_encode() escapes double quotes and backslashes but does not escape single quotes. Because the JavaScript string is delimited by single quotes, an attacker can inject a single-quote character to terminate the string literal and execute arbitrary JavaScript in the victim's browser session.\n\nThe vulnerability affects the Default and UiBeta themes, both of which render this view. The Overmind theme's own copy of the form already passed the value through an escaped data attribute and was not affected by this specific sink.\n\nPreconditions: the victim must be an authenticated MISP user and must actively open or navigate to the attacker-crafted URL. The attacker does not require an account or any prior access to the MISP instance.\n\nSecurity impact: successful exploitation allows execution of arbitrary JavaScript in the context of the MISP web application, potentially leading to session hijacking, unauthorized actions performed on behalf of the victim, exfiltration of sensitive data visible in the session, or further client-side attacks. The vulnerable component's own confidentiality, integrity, and availability are not directly compromised; the impact is on the underlying user session."}], "impacts": [{"capecId": "CAPEC-1", "descriptions": [{"lang": "en", "value": "CAPEC-1 Cross Site Scripting"}]}], "metrics": [{"cvssV4_0": {"Automatable": "NOT_DEFINED", "Recovery": "NOT_DEFINED", "Safety": "NOT_DEFINED", "attackComplexity": "LOW", "attackRequirements": "NONE", "attackVector": "NETWORK", "baseScore": 5.1, "baseSeverity": "MEDIUM", "privilegesRequired": "NONE", "providerUrgency": "NOT_DEFINED", "subAvailabilityImpact": "NONE", "subConfidentialityImpact": "LOW", "subIntegrityImpact": "LOW", "userInteraction": "ACTIVE", "valueDensity": "NOT_DEFINED", "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:L/VI:L/VA:N/SC:L/SI:L/SA:N", "version": "4.0", "vulnAvailabilityImpact": "NONE", "vulnConfidentialityImpact": "LOW", "vulnIntegrityImpact": "LOW", "vulnerabilityResponseEffort": "NOT_DEFINED"}, "format": "CVSS", "scenarios": [{"lang": "en", "value": "GENERAL"}]}], "problemTypes": [{"descriptions": [{"cweId": "CWE-79", "description": "CWE-79 Improper Neutralization of Input in Web Page ('Cross-site Scripting')", "lang": "en", "type": "CWE"}]}], "providerMetadata": {"orgId": "5a6e4751-2f3f-4070-9419-94fb35b644e8", "shortName": "CIRCL", "dateUpdated": "2026-09-22T13:01:45.225Z"}, "references": [{"name": "Security patch", "tags": ["patch"], "url": "https://github.com/MISP/MISP/commit/ad4ff238d"}], "solutions": [{"lang": "en", "supportingMedia": [{"base64": false, "type": "text/html", "value": "<p>The vulnerability is remediated by adding the JSON_HEX_TAG, JSON_HEX_APOS, JSON_HEX_QUOT, and JSON_HEX_AMP flags to the json_encode() call at the rendering sink. These flags cause angle brackets, single quotes, double quotes, and ampersands to be hex-encoded (e.g., ' becomes \\u0027), preventing any of these characters from breaking out of the single-quoted JavaScript string literal and thereby eliminating the script injection vector.</p>"}], "value": "The vulnerability is remediated by adding the JSON_HEX_TAG, JSON_HEX_APOS, JSON_HEX_QUOT, and JSON_HEX_AMP flags to the json_encode() call at the rendering sink. These flags cause angle brackets, single quotes, double quotes, and ampersands to be hex-encoded (e.g., ' becomes \\u0027), preventing any of these characters from breaking out of the single-quoted JavaScript string literal and thereby eliminating the script injection vector."}], "title": "MISP Reflected Cross-Site Scripting in Event Export Confirmation Form via Unescaped JSON", "x_gcve": [{"extensions": {"bcp-05-x-01": {"ai_annotations": [{"ai_level": "generated", "description": "Draft vulnerability metadata was generated from a git-format patch using an Ollama-hosted language model. Human validation is required before publication.", "gna_source": 1, "models": [{"gna_source": 1, "identifier": "qwen3.8:27b", "name": "qwen3.8:27b", "source": "ollama"}], "review_status": "full", "scope": "record", "tags": ["ai-computer-assisted:llm-generated", "ai-computer-assisted:classification"]}]}, "bcp-05-x-02": {"x_patch2vuln": {"assumptions": ["The tag_version_boundary metadata indicates the fix commit is 44 commits after tag v2.5.47, suggesting versions up to and including 2.5.47 may be affected, but no explicit affected or fixed version range is stated in the patch or commit message. The version boundary is inferred from repository metadata and may not be precise.", "The CVSS v4.0 AT (Attack Complexity) metric value 'N' is used as the neutral/none value; the exact valid value set for AT in CVSS v4.0 is not fully confirmed from the patch evidence alone.", "The CAPEC-1 mapping is the closest general XSS pattern available; no CAPEC specifically covers script-context reflected XSS via unescaped JSON in a single-quoted JS string, so CAPEC-1 is the best available match.", "The Overmind theme is assumed unaffected because the commit message states it already passed the value through an escaped data attribute; this is based solely on the commit message and was not independently verified.", "PR:N is assigned because the attacker does not require authentication to craft the malicious URL; the requirement that the victim be logged in is captured in UI:A rather than PR."], "capecRationale": [{"capecId": "CAPEC-1", "rationale": "The attack pattern involves injecting a script fragment (a single quote followed by arbitrary JavaScript) into a web page via a URL parameter, which is then reflected into the page's JavaScript context without proper encoding. This matches CAPEC-1 (Cross Site Scripting) directly. The injection is reflected (not stored) and occurs in a script context rather than an HTML context, but CAPEC-1 is the closest and most general applicable pattern. No more specific CAPEC for script-context reflected XSS exists in the CAPEC catalog, so CAPEC-1 is the best available match."}], "commit": "ad4ff238df978d459ac6efe0a58038748fa4a649", "confidence": "high", "credits": [{"lang": "en", "type": "reporter", "value": "Niels Teusink of Eye Security"}, {"lang": "en", "type": "remediation developer", "value": "iglocska"}, {"lang": "en", "type": "remediation developer", "value": "Claude Opus 5 (1M context)"}], "cvssRationale": "AV:N: the exploit is delivered over the network via a crafted URL. AC:L: the attack requires only crafting a URL with a single quote in the event ID list; no race conditions or special conditions are needed. AT:N: no additional attack complexity beyond what AC captures. PR:N: the attacker does not need any MISP account or privileges; the victim must be authenticated, but PR measures attacker privileges. UI:A: the victim must actively open or click the crafted link. VC/VI/VA:N: the MISP server's own confidentiality, integrity, and availability are not directly impacted. SC:L: the attacker can read session data, cookies, or other sensitive information in the victim's browser context. SI:L: the attacker can perform actions on behalf of the victim (e.g., submit forms, modify data via the API). SA:N: no impact on the availability of the underlying system.", "fixSummary": "The vulnerability is remediated by adding the JSON_HEX_TAG, JSON_HEX_APOS, JSON_HEX_QUOT, and JSON_HEX_AMP flags to the json_encode() call at the rendering sink. These flags cause angle brackets, single quotes, double quotes, and ampersands to be hex-encoded (e.g., ' becomes \\u0027), preventing any of these characters from breaking out of the single-quoted JavaScript string literal and thereby eliminating the script injection vector.", "generatedAt": "2026-09-22T12:57:11.104186Z", "generator": "patch2vuln.py", "model": "qwen3.8:27b", "modelComparison": {"rankings": [{"agreementScore": 9, "assumptionCount": 5, "confidence": "high", "model": "qwen3.8:27b", "score": 6}], "selectedModel": "qwen3.8:27b", "selectionMethod": "deterministic-consensus-v1", "selectionNotice": "The selected result is closest to model consensus; this heuristic does not establish factual correctness and human review remains required."}, "patchSha256": "b2c68a62411584c586558a3ab03529c380d9bdb0824ac292b26e7f8b3278fa01", "patchSummary": "A single-line change in app/View/Events/ajax/eventRestSearchExportConfirmationForm.ctp: the json_encode($idList) call is replaced with json_encode($idList, JSON_HEX_TAG | JSON_HEX_APOS | JSON_HEX_QUOT | JSON_HEX_AMP), ensuring that single quotes, double quotes, angle brackets, and ampersands in the event ID list are hex-escaped before being interpolated into the single-quoted JavaScript string literal in the redirectToExportResult() function.", "patchTruncated": false, "patches": [{"commit": "ad4ff238df978d459ac6efe0a58038748fa4a649", "patchSha256": "b2c68a62411584c586558a3ab03529c380d9bdb0824ac292b26e7f8b3278fa01", "source": "https://github.com/MISP/MISP/commit/ad4ff238d.patch", "sourceUrl": "https://github.com/MISP/MISP/commit/ad4ff238d.patch", "subject": "fix: [security] Escape the event id list in the export"}], "source": "https://github.com/MISP/MISP/commit/ad4ff238d.patch", "subject": "fix: [security] Escape the event id list in the export", "tagVersionBoundary": {"commits_after_fix": 44, "repository": "https://github.com/MISP/MISP", "tag": "v2.5.47", "version": "2.5.47", "version_type": "semver"}, "weaknessRationale": [{"cweId": "CWE-79", "rationale": "The root cause is the failure to neutralize a single-quote character in user-controlled input (the URL-supplied event ID list) before embedding it in a single-quoted JavaScript string context. json_encode() without hex flags does not escape single quotes, allowing script injection. This is a textbook reflected XSS (CWE-79)."}]}}}, "recordType": "advisory", "vulnId": "GCVE-1-2026-20129"}]}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2026-09-22T15:32:57.787316Z", "id": "CVE-2026-95665", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-09-22T15:33:05.484Z"}}]}}

{}

{"affected": [{"affectedData": [{"modules": ["Events export confirmation form (app/View/Events/ajax/eventRestSearchExportConfirmationForm.ctp)", "Default theme", "UiBeta theme"], "product": "MISP", "programFiles": ["app/View/Events/ajax/eventRestSearchExportConfirmationForm.ctp"], "repo": "https://github.com/MISP/MISP", "vendor": "MISP", "versions": [{"lessThan": "2.5.47", "status": "affected", "version": "0", "versionType": "semver"}]}], "source": "5a6e4751-2f3f-4070-9419-94fb35b644e8"}], "cveTags": [], "descriptions": [{"lang": "en", "value": "MISP contains a reflected cross-site scripting (XSS) vulnerability in the event REST search export confirmation form. The view template app/View/Events/ajax/eventRestSearchExportConfirmationForm.ctp renders a URL-supplied event ID list into a single-quoted JavaScript string literal using PHP's json_encode() without any hex-encoding flags. By default, json_encode() escapes double quotes and backslashes but does not escape single quotes. Because the JavaScript string is delimited by single quotes, an attacker can inject a single-quote character to terminate the string literal and execute arbitrary JavaScript in the victim's browser session.\n\nThe vulnerability affects the Default and UiBeta themes, both of which render this view. The Overmind theme's own copy of the form already passed the value through an escaped data attribute and was not affected by this specific sink.\n\nPreconditions: the victim must be an authenticated MISP user and must actively open or navigate to the attacker-crafted URL. The attacker does not require an account or any prior access to the MISP instance.\n\nSecurity impact: successful exploitation allows execution of arbitrary JavaScript in the context of the MISP web application, potentially leading to session hijacking, unauthorized actions performed on behalf of the victim, exfiltration of sensitive data visible in the session, or further client-side attacks. The vulnerable component's own confidentiality, integrity, and availability are not directly compromised; the impact is on the underlying user session."}], "id": "CVE-2026-95665", "lastModified": "2026-09-22T16:18:21.590", "metrics": {"cvssMetricV40": [{"cvssData": {"Automatable": "NOT_DEFINED", "Recovery": "NOT_DEFINED", "Safety": "NOT_DEFINED", "attackComplexity": "LOW", "attackRequirements": "NONE", "attackVector": "NETWORK", "availabilityRequirement": "NOT_DEFINED", "baseScore": 5.1, "baseSeverity": "MEDIUM", "confidentialityRequirement": "NOT_DEFINED", "exploitMaturity": "NOT_DEFINED", "integrityRequirement": "NOT_DEFINED", "modifiedAttackComplexity": "NOT_DEFINED", "modifiedAttackRequirements": "NOT_DEFINED", "modifiedAttackVector": "NOT_DEFINED", "modifiedPrivilegesRequired": "NOT_DEFINED", "modifiedSubAvailabilityImpact": "NOT_DEFINED", "modifiedSubConfidentialityImpact": "NOT_DEFINED", "modifiedSubIntegrityImpact": "NOT_DEFINED", "modifiedUserInteraction": "NOT_DEFINED", "modifiedVulnAvailabilityImpact": "NOT_DEFINED", "modifiedVulnConfidentialityImpact": "NOT_DEFINED", "modifiedVulnIntegrityImpact": "NOT_DEFINED", "privilegesRequired": "NONE", "providerUrgency": "NOT_DEFINED", "subAvailabilityImpact": "NONE", "subConfidentialityImpact": "LOW", "subIntegrityImpact": "LOW", "userInteraction": "ACTIVE", "valueDensity": "NOT_DEFINED", "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:L/VI:L/VA:N/SC:L/SI:L/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X", "version": "4.0", "vulnAvailabilityImpact": "NONE", "vulnConfidentialityImpact": "LOW", "vulnIntegrityImpact": "LOW", "vulnerabilityResponseEffort": "NOT_DEFINED"}, "source": "5a6e4751-2f3f-4070-9419-94fb35b644e8", "type": "Secondary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-95665", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "partial"}], "role": "CISA Coordinator", "timestamp": "2026-09-22T15:32:57.787316Z", "version": "2.0.3"}}]}, "published": "2026-09-22T14:17:21.180", "references": [{"source": "5a6e4751-2f3f-4070-9419-94fb35b644e8", "url": "https://github.com/MISP/MISP/commit/ad4ff238d"}], "sourceIdentifier": "5a6e4751-2f3f-4070-9419-94fb35b644e8", "vulnStatus": "Deferred", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-79"}], "source": "5a6e4751-2f3f-4070-9419-94fb35b644e8", "type": "Secondary"}]}

{}

{"affected": [{"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "[0,2.5.47)"}}], "enrichment": {"confidence": 100.0, "confidence_source": "matching", "scores": [{"score": 100.0, "source": "matching"}]}, "original": {"product": "MISP", "source": "cna", "vendor": "MISP"}, "product": "misp", "vendor": "misp"}], "created": "2026-09-22T16:15:08.122084+00:00", "updated": "2026-09-22T17:15:15.163705+00:00", "vendors": ["misp", "misp$PRODUCT$misp"]}