CVE-2026-104901 (GCVE-0-2026-104901)
Vulnerability from cvelistv5 – Published: 2026-10-02 15:21 – Updated: 2026-10-02 16:15
VLAI
EPSS
VEX
Title
MISP ID Translator: Unescaped Remote Event ID Enables Cross-Site Scripting via Linked Server
Summary
MISP contains a cross-site scripting (XSS) vulnerability in the ID Translator feature. When a user views the ID Translator page, the application queries linked (remote) MISP servers for corresponding event identifiers. The event ID returned by the remote server was rendered in the HTML output without proper output encoding.
A malicious or compromised linked server could return a crafted event ID containing arbitrary HTML or JavaScript markup. This markup would be rendered in the browser of any user in the host organization who views the ID Translator page, enabling session hijacking, credential theft, or other client-side attacks.
Preconditions:
- The victim must be an authenticated user of the host MISP instance.
- A linked server must be configured on the host instance.
- The victim must navigate to the ID Translator page for a given event.
Affected versions: <2.5.48.
Severity
SSVC
Exploitation: none
Automatable: yes
Technical Impact: partial
Supplier · CIRCL (v2.0.3)
Decision recorded 2026-10-02 15:17 UTC
Exploitation: none
Automatable: no
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-10-02 16:15 UTC
CWE
- CWE-79 - Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
Assigner
References
1 reference
| URL | Tags |
|---|---|
| https://github.com/MISP/MISP/commit/bd5e80c84 | patch |
Impacted products
GCVE extensions
AI-generated
Human-reviewed
Confidence: medium
Model
qwen3.8:27b
1 event
advisory
bcp-05-x-01bcp-05-x-02bcp-05-x-03
Draft vulnerability metadata was generated from a git-format patch using an Ollama-hosted language model. Human validation is required before publication.
ai-computer-assisted:llm-generatedai-computer-assisted:classification
| Model | Source | Identifier |
|---|---|---|
| qwen3.8:27b | ollama | qwen3.8:27b |
- Generator
-
patch2vuln.pyon 2026-10-02 15:17 - Model
qwen3.8:27b- Input
-
https://github.com/MISP/MISP/commit/bd5e80c84.patch
398814c5f528… - Confidence
- medium
| Commit | Subject | Patch SHA-256 |
|---|---|---|
bd5e80c84f0a
|
fix: [security] Treat the remote event id in the ID | 398814c5f528… |
Fix summary
The vulnerability is remediated by enforcing integer typing on the remote event ID at the point where it enters the application data structure in the controller, and by applying HTML output encoding (the h() helper) to all user-visible fields (remote_id, server_id) in both the default and Overmind-themed ID Translator views. This ensures that even if a remote server returns non-numeric or markup-laden data, it cannot be interpreted as HTML by the browser.
Patch summary
In ServersController.php, the remote_event['id'] value is cast to (int) in two locations where it is stored in the remote_events array and where it is extracted from the API response. In app/View/Servers/id_translator.ctp, the h() escaping function is applied to remote_id in the anchor text and to both server_id and remote_id in the preview URL. In app/View/Themed/Overmind/Servers/id_translator.ctp, h() is applied to remote_id in the badge display and to server_id and remote_id in the preview link. An 'exception' key is also initialized to null in the first array construction for consistency.
CVSS rationale
AV:N: The attack originates from a remote linked server over the network. AC:L: No race conditions or special timing are required; the linked server simply returns a crafted ID. AT:N: No active user interaction is needed to set up the attack (the malicious server is already linked). PR:N: The attacker is the linked server itself and does not need credentials on the victim's instance. UI:A: The victim must actively navigate to the ID Translator page for the payload to execute. VC:N/VI:N/VA:N: The vulnerable component (MISP server) is not directly compromised; the impact is client-side. SC:L: A successful XSS can read cookies, session tokens, or page data in the victim's browser. SI:L: The attacker can modify the rendered page content. SA:N: No impact on the security authority of the system.
Weakness rationale
- CWE-79 The remote event ID returned by a linked server was rendered in HTML output without output encoding, allowing injection of arbitrary markup or script. The fix applies HTML escaping (h()) and integer casting, which is the canonical remediation for CWE-79.
Attack pattern rationale
- CAPEC-1 The closest CAPEC pattern is reflected XSS: data originating from an external source (the linked server's API response) is reflected into the rendered HTML page without encoding. The mapping is slightly imprecise because the data source is a server-to-server API response rather than a direct user-supplied request parameter, but the mechanism (untrusted data reflected into HTML) matches CAPEC-1 most closely among available patterns. CAPEC-120 (Persistent XSS) was considered but the data is not stored in the victim's database; it is fetched live from the remote server and rendered, making the reflected pattern a better fit.
Assumptions to verify
- The affected version boundary is inferred from the tag_version_boundary metadata (v2.5.48, 30 commits after fix); the exact first affected version is not specified in the patch.
- The CAPEC-1 mapping is the closest available pattern; the data source is a server-to-server API response rather than a direct HTTP request parameter, making the 'reflected' classification slightly imprecise.
- The attacker is assumed to be a configured linked MISP server; no evidence suggests the vulnerability is exploitable without a pre-existing server link.
- The UI:A rating assumes the victim must explicitly navigate to the ID Translator page; it is unclear whether any automated workflow could trigger this view without direct user action.
- The Co-Authored-By line references an AI assistant; it is credited as a tool rather than a human remediation developer.
Model comparison
Selected qwen3.8:27b
by deterministic-consensus-v1
The selected result is closest to model consensus; this heuristic does not establish factual correctness and human review remains required.
| Model | Score | Agreement | Confidence | Assumptions |
|---|---|---|---|---|
qwen3.8:27b |
7 | 11 | medium | 5 |
- 2026-09-24 21:24 UTC Fix developed Corrective change authored (bd5e80c84f0ab853d88d14e14df9bd92786eb8f4): fix: [security] Treat the remote event id in the ID https://github.com/MISP/MISP/commit/bd5e80c84.patch
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-104901",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-10-02T16:15:35.943839Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-10-02T16:15:49.327Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"cpes": [
"cpe:2.3:a:misp:misp:*:*:*:*:*:*:*:*"
],
"modules": [
"ServersController (idTranslator)",
"View/Servers/id_translator.ctp",
"View/Themed/Overmind/Servers/id_translator.ctp"
],
"product": "MISP",
"programFiles": [
"app/Controller/ServersController.php",
"app/View/Servers/id_translator.ctp",
"app/View/Themed/Overmind/Servers/id_translator.ctp"
],
"repo": "https://github.com/MISP/MISP",
"vendor": "MISP",
"versions": [
{
"lessThan": "2.5.48",
"status": "affected",
"version": "0",
"versionType": "semver"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "reporter",
"value": "Jeroen Pinoy"
},
{
"lang": "en",
"type": "remediation developer",
"value": "iglocska"
},
{
"lang": "en",
"type": "remediation developer",
"value": "Claude Opus 5.5 (1M context)"
}
],
"descriptions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "\u003cp\u003eMISP contains a cross-site scripting (XSS) vulnerability in the ID Translator feature. When a user views the ID Translator page, the application queries linked (remote) MISP servers for corresponding event identifiers. The event ID returned by the remote server was rendered in the HTML output without proper output encoding.\u003c/p\u003e\u003cp\u003eA malicious or compromised linked server could return a crafted event ID containing arbitrary HTML or JavaScript markup. This markup would be rendered in the browser of any user in the host organization who views the ID Translator page, enabling session hijacking, credential theft, or other client-side attacks.\u003c/p\u003e\u003cp\u003ePreconditions:\u003c/p\u003e\u003cp\u003e- The victim must be an authenticated user of the host MISP instance.\u003c/p\u003e\u003cp\u003e- A linked server must be configured on the host instance.\u003c/p\u003e\u003cp\u003e- The victim must navigate to the ID Translator page for a given event.\u003c/p\u003e\u003cp\u003eAffected versions: \u0026lt;2.5.48.\u003c/p\u003e"
}
],
"value": "MISP contains a cross-site scripting (XSS) vulnerability in the ID Translator feature. When a user views the ID Translator page, the application queries linked (remote) MISP servers for corresponding event identifiers. The event ID returned by the remote server was rendered in the HTML output without proper output encoding.\n\nA malicious or compromised linked server could return a crafted event ID containing arbitrary HTML or JavaScript markup. This markup would be rendered in the browser of any user in the host organization who views the ID Translator page, enabling session hijacking, credential theft, or other client-side attacks.\n\nPreconditions:\n\n- The victim must be an authenticated user of the host MISP instance.\n\n- A linked server must be configured on the host instance.\n\n- The victim must navigate to the ID Translator page for a given event.\n\nAffected versions: \u003c2.5.48."
}
],
"impacts": [
{
"capecId": "CAPEC-1",
"descriptions": [
{
"lang": "en",
"value": "CAPEC-1 XSS - Reflected"
}
]
}
],
"metrics": [
{
"cvssV4_0": {
"Automatable": "NOT_DEFINED",
"Recovery": "NOT_DEFINED",
"Safety": "NOT_DEFINED",
"attackComplexity": "LOW",
"attackRequirements": "NONE",
"attackVector": "NETWORK",
"baseScore": 5.1,
"baseSeverity": "MEDIUM",
"privilegesRequired": "NONE",
"providerUrgency": "NOT_DEFINED",
"subAvailabilityImpact": "NONE",
"subConfidentialityImpact": "LOW",
"subIntegrityImpact": "LOW",
"userInteraction": "ACTIVE",
"valueDensity": "NOT_DEFINED",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N",
"version": "4.0",
"vulnAvailabilityImpact": "NONE",
"vulnConfidentialityImpact": "NONE",
"vulnIntegrityImpact": "NONE",
"vulnerabilityResponseEffort": "NOT_DEFINED"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
},
{
"format": "SSVC",
"other": {
"content": {
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "yes"
},
{
"Technical Impact": "partial"
}
],
"role": "Supplier",
"timestamp": "2026-10-02T15:17:39Z",
"version": "2.0.3"
},
"type": "SSVC"
},
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-79",
"description": "CWE-79 Improper Neutralization of Input During Web Page Generation (\u0027Cross-site Scripting\u0027)",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-10-02T15:21:53.492Z",
"orgId": "5a6e4751-2f3f-4070-9419-94fb35b644e8",
"shortName": "CIRCL"
},
"references": [
{
"name": "Security patch",
"tags": [
"patch"
],
"url": "https://github.com/MISP/MISP/commit/bd5e80c84"
}
],
"solutions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "\u003cp\u003eThe vulnerability is remediated by enforcing integer typing on the remote event ID at the point where it enters the application data structure in the controller, and by applying HTML output encoding (the h() helper) to all user-visible fields (remote_id, server_id) in both the default and Overmind-themed ID Translator views. This ensures that even if a remote server returns non-numeric or markup-laden data, it cannot be interpreted as HTML by the browser.\u003c/p\u003e"
}
],
"value": "The vulnerability is remediated by enforcing integer typing on the remote event ID at the point where it enters the application data structure in the controller, and by applying HTML output encoding (the h() helper) to all user-visible fields (remote_id, server_id) in both the default and Overmind-themed ID Translator views. This ensures that even if a remote server returns non-numeric or markup-laden data, it cannot be interpreted as HTML by the browser."
}
],
"title": "MISP ID Translator: Unescaped Remote Event ID Enables Cross-Site Scripting via Linked Server",
"x_gcve": [
{
"extensions": {
"bcp-05-x-01": {
"ai_annotations": [
{
"ai_level": "generated",
"description": "Draft vulnerability metadata was generated from a git-format patch using an Ollama-hosted language model. Human validation is required before publication.",
"gna_source": 1,
"models": [
{
"gna_source": 1,
"identifier": "qwen3.8:27b",
"name": "qwen3.8:27b",
"source": "ollama"
}
],
"review_status": "full",
"scope": "record",
"tags": [
"ai-computer-assisted:llm-generated",
"ai-computer-assisted:classification"
]
}
]
},
"bcp-05-x-02": {
"x_patch2vuln": {
"assumptions": [
"The affected version boundary is inferred from the tag_version_boundary metadata (v2.5.48, 30 commits after fix); the exact first affected version is not specified in the patch.",
"The CAPEC-1 mapping is the closest available pattern; the data source is a server-to-server API response rather than a direct HTTP request parameter, making the \u0027reflected\u0027 classification slightly imprecise.",
"The attacker is assumed to be a configured linked MISP server; no evidence suggests the vulnerability is exploitable without a pre-existing server link.",
"The UI:A rating assumes the victim must explicitly navigate to the ID Translator page; it is unclear whether any automated workflow could trigger this view without direct user action.",
"The Co-Authored-By line references an AI assistant; it is credited as a tool rather than a human remediation developer."
],
"capecRationale": [
{
"capecId": "CAPEC-1",
"rationale": "The closest CAPEC pattern is reflected XSS: data originating from an external source (the linked server\u0027s API response) is reflected into the rendered HTML page without encoding. The mapping is slightly imprecise because the data source is a server-to-server API response rather than a direct user-supplied request parameter, but the mechanism (untrusted data reflected into HTML) matches CAPEC-1 most closely among available patterns. CAPEC-120 (Persistent XSS) was considered but the data is not stored in the victim\u0027s database; it is fetched live from the remote server and rendered, making the reflected pattern a better fit."
}
],
"commit": "bd5e80c84f0ab853d88d14e14df9bd92786eb8f4",
"confidence": "medium",
"credits": [
{
"lang": "en",
"type": "reporter",
"value": "Jeroen Pinoy"
},
{
"lang": "en",
"type": "remediation developer",
"value": "iglocska"
},
{
"lang": "en",
"type": "remediation developer",
"value": "Claude Opus 5.5 (1M context)"
}
],
"cvssRationale": "AV:N: The attack originates from a remote linked server over the network. AC:L: No race conditions or special timing are required; the linked server simply returns a crafted ID. AT:N: No active user interaction is needed to set up the attack (the malicious server is already linked). PR:N: The attacker is the linked server itself and does not need credentials on the victim\u0027s instance. UI:A: The victim must actively navigate to the ID Translator page for the payload to execute. VC:N/VI:N/VA:N: The vulnerable component (MISP server) is not directly compromised; the impact is client-side. SC:L: A successful XSS can read cookies, session tokens, or page data in the victim\u0027s browser. SI:L: The attacker can modify the rendered page content. SA:N: No impact on the security authority of the system.",
"fixSummary": "The vulnerability is remediated by enforcing integer typing on the remote event ID at the point where it enters the application data structure in the controller, and by applying HTML output encoding (the h() helper) to all user-visible fields (remote_id, server_id) in both the default and Overmind-themed ID Translator views. This ensures that even if a remote server returns non-numeric or markup-laden data, it cannot be interpreted as HTML by the browser.",
"generatedAt": "2026-10-02T15:17:39.791225Z",
"generator": "patch2vuln.py",
"model": "qwen3.8:27b",
"modelComparison": {
"rankings": [
{
"agreementScore": 11,
"assumptionCount": 5,
"confidence": "medium",
"model": "qwen3.8:27b",
"score": 7
}
],
"selectedModel": "qwen3.8:27b",
"selectionMethod": "deterministic-consensus-v1",
"selectionNotice": "The selected result is closest to model consensus; this heuristic does not establish factual correctness and human review remains required."
},
"patchSha256": "398814c5f528eb504bfc173c7ed3258a171d9f3feeca03d8ba4fff252d3a8c1f",
"patchSummary": "In ServersController.php, the remote_event[\u0027id\u0027] value is cast to (int) in two locations where it is stored in the remote_events array and where it is extracted from the API response. In app/View/Servers/id_translator.ctp, the h() escaping function is applied to remote_id in the anchor text and to both server_id and remote_id in the preview URL. In app/View/Themed/Overmind/Servers/id_translator.ctp, h() is applied to remote_id in the badge display and to server_id and remote_id in the preview link. An \u0027exception\u0027 key is also initialized to null in the first array construction for consistency.",
"patchTruncated": false,
"patches": [
{
"commit": "bd5e80c84f0ab853d88d14e14df9bd92786eb8f4",
"date": "Thu, 24 Sep 2026 23:24:11 +0200",
"patchSha256": "398814c5f528eb504bfc173c7ed3258a171d9f3feeca03d8ba4fff252d3a8c1f",
"source": "https://github.com/MISP/MISP/commit/bd5e80c84.patch",
"sourceUrl": "https://github.com/MISP/MISP/commit/bd5e80c84.patch",
"subject": "fix: [security] Treat the remote event id in the ID"
}
],
"source": "https://github.com/MISP/MISP/commit/bd5e80c84.patch",
"ssvc": {
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "yes"
},
{
"Technical Impact": "partial"
}
],
"role": "Supplier",
"timestamp": "2026-10-02T15:17:39Z",
"version": "2.0.3"
},
"subject": "fix: [security] Treat the remote event id in the ID",
"tagVersionBoundary": {
"commits_after_fix": 30,
"repository": "https://github.com/MISP/MISP",
"tag": "v2.5.48",
"version": "2.5.48",
"version_type": "semver"
},
"weaknessRationale": [
{
"cweId": "CWE-79",
"rationale": "The remote event ID returned by a linked server was rendered in HTML output without output encoding, allowing injection of arbitrary markup or script. The fix applies HTML escaping (h()) and integer casting, which is the canonical remediation for CWE-79."
}
]
}
},
"bcp-05-x-03": {
"x_timeline": {
"events": [
{
"description": "Corrective change authored (bd5e80c84f0ab853d88d14e14df9bd92786eb8f4): fix: [security] Treat the remote event id in the ID",
"id": "evt-fix-developed-1",
"references": [
"https://github.com/MISP/MISP/commit/bd5e80c84.patch"
],
"timestamp": "2026-09-24T21:24:11Z",
"type": "fix-developed"
}
]
}
}
},
"recordType": "advisory",
"vulnId": "GCVE-1-2026-20296"
}
]
}
},
"cveMetadata": {
"assignerOrgId": "5a6e4751-2f3f-4070-9419-94fb35b644e8",
"assignerShortName": "CIRCL",
"cveId": "CVE-2026-104901",
"datePublished": "2026-10-02T15:21:53.492Z",
"dateReserved": "2026-10-02T15:21:46.840Z",
"dateUpdated": "2026-10-02T16:15:49.327Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2",
"vulnerability-lookup:meta": {
"nvd": {
"cve": {
"affected": [
{
"affectedData": [
{
"cpes": [
"cpe:2.3:a:misp:misp:*:*:*:*:*:*:*:*"
],
"modules": [
"ServersController (idTranslator)",
"View/Servers/id_translator.ctp",
"View/Themed/Overmind/Servers/id_translator.ctp"
],
"product": "MISP",
"programFiles": [
"app/Controller/ServersController.php",
"app/View/Servers/id_translator.ctp",
"app/View/Themed/Overmind/Servers/id_translator.ctp"
],
"repo": "https://github.com/MISP/MISP",
"vendor": "MISP",
"versions": [
{
"lessThan": "2.5.48",
"status": "affected",
"version": "0",
"versionType": "semver"
}
]
}
],
"source": "5a6e4751-2f3f-4070-9419-94fb35b644e8"
}
],
"cveTags": [],
"descriptions": [
{
"lang": "en",
"value": "MISP contains a cross-site scripting (XSS) vulnerability in the ID Translator feature. When a user views the ID Translator page, the application queries linked (remote) MISP servers for corresponding event identifiers. The event ID returned by the remote server was rendered in the HTML output without proper output encoding.\n\nA malicious or compromised linked server could return a crafted event ID containing arbitrary HTML or JavaScript markup. This markup would be rendered in the browser of any user in the host organization who views the ID Translator page, enabling session hijacking, credential theft, or other client-side attacks.\n\nPreconditions:\n\n- The victim must be an authenticated user of the host MISP instance.\n\n- A linked server must be configured on the host instance.\n\n- The victim must navigate to the ID Translator page for a given event.\n\nAffected versions: \u003c2.5.48."
}
],
"id": "CVE-2026-104901",
"lastModified": "2026-10-02T17:17:04.413",
"metrics": {
"cvssMetricV40": [
{
"cvssData": {
"Automatable": "NOT_DEFINED",
"Recovery": "NOT_DEFINED",
"Safety": "NOT_DEFINED",
"attackComplexity": "LOW",
"attackRequirements": "NONE",
"attackVector": "NETWORK",
"availabilityRequirement": "NOT_DEFINED",
"baseScore": 5.1,
"baseSeverity": "MEDIUM",
"confidentialityRequirement": "NOT_DEFINED",
"exploitMaturity": "NOT_DEFINED",
"integrityRequirement": "NOT_DEFINED",
"modifiedAttackComplexity": "NOT_DEFINED",
"modifiedAttackRequirements": "NOT_DEFINED",
"modifiedAttackVector": "NOT_DEFINED",
"modifiedPrivilegesRequired": "NOT_DEFINED",
"modifiedSubAvailabilityImpact": "NOT_DEFINED",
"modifiedSubConfidentialityImpact": "NOT_DEFINED",
"modifiedSubIntegrityImpact": "NOT_DEFINED",
"modifiedUserInteraction": "NOT_DEFINED",
"modifiedVulnAvailabilityImpact": "NOT_DEFINED",
"modifiedVulnConfidentialityImpact": "NOT_DEFINED",
"modifiedVulnIntegrityImpact": "NOT_DEFINED",
"privilegesRequired": "NONE",
"providerUrgency": "NOT_DEFINED",
"subAvailabilityImpact": "NONE",
"subConfidentialityImpact": "LOW",
"subIntegrityImpact": "LOW",
"userInteraction": "ACTIVE",
"valueDensity": "NOT_DEFINED",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X",
"version": "4.0",
"vulnAvailabilityImpact": "NONE",
"vulnConfidentialityImpact": "NONE",
"vulnIntegrityImpact": "NONE",
"vulnerabilityResponseEffort": "NOT_DEFINED"
},
"source": "5a6e4751-2f3f-4070-9419-94fb35b644e8",
"type": "Secondary"
}
],
"ssvcV203": [
{
"source": "5a6e4751-2f3f-4070-9419-94fb35b644e8",
"ssvcData": {
"options": [
{
"exploitation": "none"
},
{
"automatable": "yes"
},
{
"technicalImpact": "partial"
}
],
"role": "Supplier",
"timestamp": "2026-10-02T15:17:39Z",
"version": "2.0.3"
}
},
{
"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"ssvcData": {
"id": "CVE-2026-104901",
"options": [
{
"exploitation": "none"
},
{
"automatable": "no"
},
{
"technicalImpact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-10-02T16:15:35.943839Z",
"version": "2.0.3"
}
}
]
},
"published": "2026-10-02T16:16:47.797",
"references": [
{
"source": "5a6e4751-2f3f-4070-9419-94fb35b644e8",
"url": "https://github.com/MISP/MISP/commit/bd5e80c84"
}
],
"sourceIdentifier": "5a6e4751-2f3f-4070-9419-94fb35b644e8",
"vulnStatus": "Deferred",
"weaknesses": [
{
"description": [
{
"lang": "en",
"value": "CWE-79"
}
],
"source": "5a6e4751-2f3f-4070-9419-94fb35b644e8",
"type": "Secondary"
}
]
}
},
"vulnrichment": {
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-104901",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-10-02T16:15:35.943839Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-10-02T16:15:42.544Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"cpes": [
"cpe:2.3:a:misp:misp:*:*:*:*:*:*:*:*"
],
"modules": [
"ServersController (idTranslator)",
"View/Servers/id_translator.ctp",
"View/Themed/Overmind/Servers/id_translator.ctp"
],
"product": "MISP",
"programFiles": [
"app/Controller/ServersController.php",
"app/View/Servers/id_translator.ctp",
"app/View/Themed/Overmind/Servers/id_translator.ctp"
],
"repo": "https://github.com/MISP/MISP",
"vendor": "MISP",
"versions": [
{
"lessThan": "2.5.48",
"status": "affected",
"version": "0",
"versionType": "semver"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "reporter",
"value": "Jeroen Pinoy"
},
{
"lang": "en",
"type": "remediation developer",
"value": "iglocska"
},
{
"lang": "en",
"type": "remediation developer",
"value": "Claude Opus 5.5 (1M context)"
}
],
"descriptions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "\u003cp\u003eMISP contains a cross-site scripting (XSS) vulnerability in the ID Translator feature. When a user views the ID Translator page, the application queries linked (remote) MISP servers for corresponding event identifiers. The event ID returned by the remote server was rendered in the HTML output without proper output encoding.\u003c/p\u003e\u003cp\u003eA malicious or compromised linked server could return a crafted event ID containing arbitrary HTML or JavaScript markup. This markup would be rendered in the browser of any user in the host organization who views the ID Translator page, enabling session hijacking, credential theft, or other client-side attacks.\u003c/p\u003e\u003cp\u003ePreconditions:\u003c/p\u003e\u003cp\u003e- The victim must be an authenticated user of the host MISP instance.\u003c/p\u003e\u003cp\u003e- A linked server must be configured on the host instance.\u003c/p\u003e\u003cp\u003e- The victim must navigate to the ID Translator page for a given event.\u003c/p\u003e\u003cp\u003eAffected versions: \u0026lt;2.5.48.\u003c/p\u003e"
}
],
"value": "MISP contains a cross-site scripting (XSS) vulnerability in the ID Translator feature. When a user views the ID Translator page, the application queries linked (remote) MISP servers for corresponding event identifiers. The event ID returned by the remote server was rendered in the HTML output without proper output encoding.\n\nA malicious or compromised linked server could return a crafted event ID containing arbitrary HTML or JavaScript markup. This markup would be rendered in the browser of any user in the host organization who views the ID Translator page, enabling session hijacking, credential theft, or other client-side attacks.\n\nPreconditions:\n\n- The victim must be an authenticated user of the host MISP instance.\n\n- A linked server must be configured on the host instance.\n\n- The victim must navigate to the ID Translator page for a given event.\n\nAffected versions: \u003c2.5.48."
}
],
"impacts": [
{
"capecId": "CAPEC-1",
"descriptions": [
{
"lang": "en",
"value": "CAPEC-1 XSS - Reflected"
}
]
}
],
"metrics": [
{
"cvssV4_0": {
"Automatable": "NOT_DEFINED",
"Recovery": "NOT_DEFINED",
"Safety": "NOT_DEFINED",
"attackComplexity": "LOW",
"attackRequirements": "NONE",
"attackVector": "NETWORK",
"baseScore": 5.1,
"baseSeverity": "MEDIUM",
"privilegesRequired": "NONE",
"providerUrgency": "NOT_DEFINED",
"subAvailabilityImpact": "NONE",
"subConfidentialityImpact": "LOW",
"subIntegrityImpact": "LOW",
"userInteraction": "ACTIVE",
"valueDensity": "NOT_DEFINED",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N",
"version": "4.0",
"vulnAvailabilityImpact": "NONE",
"vulnConfidentialityImpact": "NONE",
"vulnIntegrityImpact": "NONE",
"vulnerabilityResponseEffort": "NOT_DEFINED"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
},
{
"format": "SSVC",
"other": {
"content": {
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "yes"
},
{
"Technical Impact": "partial"
}
],
"role": "Supplier",
"timestamp": "2026-10-02T15:17:39Z",
"version": "2.0.3"
},
"type": "SSVC"
},
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-79",
"description": "CWE-79 Improper Neutralization of Input During Web Page Generation (\u0027Cross-site Scripting\u0027)",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-10-02T15:21:53.492Z",
"orgId": "5a6e4751-2f3f-4070-9419-94fb35b644e8",
"shortName": "CIRCL"
},
"references": [
{
"name": "Security patch",
"tags": [
"patch"
],
"url": "https://github.com/MISP/MISP/commit/bd5e80c84"
}
],
"solutions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "\u003cp\u003eThe vulnerability is remediated by enforcing integer typing on the remote event ID at the point where it enters the application data structure in the controller, and by applying HTML output encoding (the h() helper) to all user-visible fields (remote_id, server_id) in both the default and Overmind-themed ID Translator views. This ensures that even if a remote server returns non-numeric or markup-laden data, it cannot be interpreted as HTML by the browser.\u003c/p\u003e"
}
],
"value": "The vulnerability is remediated by enforcing integer typing on the remote event ID at the point where it enters the application data structure in the controller, and by applying HTML output encoding (the h() helper) to all user-visible fields (remote_id, server_id) in both the default and Overmind-themed ID Translator views. This ensures that even if a remote server returns non-numeric or markup-laden data, it cannot be interpreted as HTML by the browser."
}
],
"title": "MISP ID Translator: Unescaped Remote Event ID Enables Cross-Site Scripting via Linked Server",
"x_gcve": [
{
"extensions": {
"bcp-05-x-01": {
"ai_annotations": [
{
"ai_level": "generated",
"description": "Draft vulnerability metadata was generated from a git-format patch using an Ollama-hosted language model. Human validation is required before publication.",
"gna_source": 1,
"models": [
{
"gna_source": 1,
"identifier": "qwen3.8:27b",
"name": "qwen3.8:27b",
"source": "ollama"
}
],
"review_status": "full",
"scope": "record",
"tags": [
"ai-computer-assisted:llm-generated",
"ai-computer-assisted:classification"
]
}
]
},
"bcp-05-x-02": {
"x_patch2vuln": {
"assumptions": [
"The affected version boundary is inferred from the tag_version_boundary metadata (v2.5.48, 30 commits after fix); the exact first affected version is not specified in the patch.",
"The CAPEC-1 mapping is the closest available pattern; the data source is a server-to-server API response rather than a direct HTTP request parameter, making the \u0027reflected\u0027 classification slightly imprecise.",
"The attacker is assumed to be a configured linked MISP server; no evidence suggests the vulnerability is exploitable without a pre-existing server link.",
"The UI:A rating assumes the victim must explicitly navigate to the ID Translator page; it is unclear whether any automated workflow could trigger this view without direct user action.",
"The Co-Authored-By line references an AI assistant; it is credited as a tool rather than a human remediation developer."
],
"capecRationale": [
{
"capecId": "CAPEC-1",
"rationale": "The closest CAPEC pattern is reflected XSS: data originating from an external source (the linked server\u0027s API response) is reflected into the rendered HTML page without encoding. The mapping is slightly imprecise because the data source is a server-to-server API response rather than a direct user-supplied request parameter, but the mechanism (untrusted data reflected into HTML) matches CAPEC-1 most closely among available patterns. CAPEC-120 (Persistent XSS) was considered but the data is not stored in the victim\u0027s database; it is fetched live from the remote server and rendered, making the reflected pattern a better fit."
}
],
"commit": "bd5e80c84f0ab853d88d14e14df9bd92786eb8f4",
"confidence": "medium",
"credits": [
{
"lang": "en",
"type": "reporter",
"value": "Jeroen Pinoy"
},
{
"lang": "en",
"type": "remediation developer",
"value": "iglocska"
},
{
"lang": "en",
"type": "remediation developer",
"value": "Claude Opus 5.5 (1M context)"
}
],
"cvssRationale": "AV:N: The attack originates from a remote linked server over the network. AC:L: No race conditions or special timing are required; the linked server simply returns a crafted ID. AT:N: No active user interaction is needed to set up the attack (the malicious server is already linked). PR:N: The attacker is the linked server itself and does not need credentials on the victim\u0027s instance. UI:A: The victim must actively navigate to the ID Translator page for the payload to execute. VC:N/VI:N/VA:N: The vulnerable component (MISP server) is not directly compromised; the impact is client-side. SC:L: A successful XSS can read cookies, session tokens, or page data in the victim\u0027s browser. SI:L: The attacker can modify the rendered page content. SA:N: No impact on the security authority of the system.",
"fixSummary": "The vulnerability is remediated by enforcing integer typing on the remote event ID at the point where it enters the application data structure in the controller, and by applying HTML output encoding (the h() helper) to all user-visible fields (remote_id, server_id) in both the default and Overmind-themed ID Translator views. This ensures that even if a remote server returns non-numeric or markup-laden data, it cannot be interpreted as HTML by the browser.",
"generatedAt": "2026-10-02T15:17:39.791225Z",
"generator": "patch2vuln.py",
"model": "qwen3.8:27b",
"modelComparison": {
"rankings": [
{
"agreementScore": 11,
"assumptionCount": 5,
"confidence": "medium",
"model": "qwen3.8:27b",
"score": 7
}
],
"selectedModel": "qwen3.8:27b",
"selectionMethod": "deterministic-consensus-v1",
"selectionNotice": "The selected result is closest to model consensus; this heuristic does not establish factual correctness and human review remains required."
},
"patchSha256": "398814c5f528eb504bfc173c7ed3258a171d9f3feeca03d8ba4fff252d3a8c1f",
"patchSummary": "In ServersController.php, the remote_event[\u0027id\u0027] value is cast to (int) in two locations where it is stored in the remote_events array and where it is extracted from the API response. In app/View/Servers/id_translator.ctp, the h() escaping function is applied to remote_id in the anchor text and to both server_id and remote_id in the preview URL. In app/View/Themed/Overmind/Servers/id_translator.ctp, h() is applied to remote_id in the badge display and to server_id and remote_id in the preview link. An \u0027exception\u0027 key is also initialized to null in the first array construction for consistency.",
"patchTruncated": false,
"patches": [
{
"commit": "bd5e80c84f0ab853d88d14e14df9bd92786eb8f4",
"date": "Thu, 24 Sep 2026 23:24:11 +0200",
"patchSha256": "398814c5f528eb504bfc173c7ed3258a171d9f3feeca03d8ba4fff252d3a8c1f",
"source": "https://github.com/MISP/MISP/commit/bd5e80c84.patch",
"sourceUrl": "https://github.com/MISP/MISP/commit/bd5e80c84.patch",
"subject": "fix: [security] Treat the remote event id in the ID"
}
],
"source": "https://github.com/MISP/MISP/commit/bd5e80c84.patch",
"ssvc": {
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "yes"
},
{
"Technical Impact": "partial"
}
],
"role": "Supplier",
"timestamp": "2026-10-02T15:17:39Z",
"version": "2.0.3"
},
"subject": "fix: [security] Treat the remote event id in the ID",
"tagVersionBoundary": {
"commits_after_fix": 30,
"repository": "https://github.com/MISP/MISP",
"tag": "v2.5.48",
"version": "2.5.48",
"version_type": "semver"
},
"weaknessRationale": [
{
"cweId": "CWE-79",
"rationale": "The remote event ID returned by a linked server was rendered in HTML output without output encoding, allowing injection of arbitrary markup or script. The fix applies HTML escaping (h()) and integer casting, which is the canonical remediation for CWE-79."
}
]
}
},
"bcp-05-x-03": {
"x_timeline": {
"events": [
{
"description": "Corrective change authored (bd5e80c84f0ab853d88d14e14df9bd92786eb8f4): fix: [security] Treat the remote event id in the ID",
"id": "evt-fix-developed-1",
"references": [
"https://github.com/MISP/MISP/commit/bd5e80c84.patch"
],
"timestamp": "2026-09-24T21:24:11Z",
"type": "fix-developed"
}
]
}
}
},
"recordType": "advisory",
"vulnId": "GCVE-1-2026-20296"
}
]
}
},
"cveMetadata": {
"assignerOrgId": "5a6e4751-2f3f-4070-9419-94fb35b644e8",
"assignerShortName": "CIRCL",
"cveId": "CVE-2026-104901",
"datePublished": "2026-10-02T15:21:53.492Z",
"dateReserved": "2026-10-02T15:21:46.840Z",
"dateUpdated": "2026-10-02T16:15:49.327Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
}
}
Loading…
Loading…
Experimental. This forecast is provided for visualization only and may change without notice. Do not use it for operational decisions.
Forecast uses a logistic model when the trend is rising, or an exponential decay model when the trend is falling. Fitted via linearized least squares.
Sightings
| Author | Source | Type | Date | Other |
|---|
Nomenclature
- Seen: The vulnerability was mentioned, discussed, or observed by the user.
- Confirmed: The vulnerability has been validated from an analyst's perspective.
- Published Proof of Concept: A public proof of concept is available for this vulnerability.
- Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
- Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
- Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
- Not confirmed: The user expressed doubt about the validity of the vulnerability.
- Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.
Loading…
Loading…
The MITRE ATT&CK techniques below are AI-generated suggestions, inferred from the description of the
vulnerability by the CIRCL/vulnerability-attack-technique-classification-roberta-base
model, served locally by ML-Gateway.
They have not been verified by an analyst and are provided for guidance only.
The approach is described in our paper Mapping CVEs to MITRE ATT&CK Techniques: A Curated Gold-Set Classifier and the Limits of LLM-Assisted Label Expansion.
Browse all ATT&CK techniques and the vulnerabilities related to each.
The approach is described in our paper Mapping CVEs to MITRE ATT&CK Techniques: A Curated Gold-Set Classifier and the Limits of LLM-Assisted Label Expansion.
Browse all ATT&CK techniques and the vulnerabilities related to each.
Loading…
Related by attack behaviour
Vulnerabilities whose description is nearest to this one in the vector space of the CIRCL/vulnerability-attack-technique-biencoder model. This is a similarity search over the bi-encoder space (plain cosine), not a classification, and it has no measured accuracy.
Loading…