{"id":"CVE-2026-112184","title":"MISP Workflow Module: Reflected XSS via Unescaped misp-modules Parameter Names in Form Labels","summary":"MISP contains a reflected cross-site scripting (XSS) vulnerability in the workflow module interface. Parameter names returned by the misp-modules service are rendered as raw HTML form labels on the workflow module page without output enc…","severity":"medium","cvss":4.8,"cvssVector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:A/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N","cvssSource":"cna","cwe":["CWE-79"],"vendor":"MISP","product":"MISP","affected":["MISP < 2.5.48"],"published":"2026-10-19","updated":"2026-10-19","sourceUpdated":"2026-10-19T09:19:45.056Z","source":"CVEORG","sourceUrl":"https://www.cve.org/CVERecord?id=CVE-2026-112184","references":[{"url":"https://github.com/MISP/MISP/commit/813a48b2b","label":"Security patch"}],"tags":["cve.org"],"ingestedAt":"2026-10-19T11:23:01.730Z","slug":"CVE-2026-112184","body":"## Overview\n\nMISP contains a reflected cross-site scripting (XSS) vulnerability in the workflow module interface. Parameter names returned by the misp-modules service are rendered as raw HTML form labels on the workflow module page without output encoding. An attacker who can influence the parameter names reported by the misp-modules service can inject arbitrary HTML or JavaScript that executes in the context of an authenticated MISP user's browser.\n\nPreconditions:\n\n- The attacker must be able to control or influence parameter names reported by the misp-modules service.\n\n- A victim must be authenticated and view the affected workflow module page.\n\nImpact:\n\n- Execution of arbitrary JavaScript in the victim's browser session.\n\n- Potential theft of session tokens, manipulation of the MISP interface, or initiation of unauthorized actions on behalf of the victim.\n\nAffected versions: <2.5.48.\n\n## Affected\n\n- `MISP < 2.5.48`\n\n## Remediation\n\nThe fix applies HTML output encoding (the h() helper) to the parameter name before it is used as a form label, ensuring that any HTML metacharacters in the value are neutralized and rendered as inert text rather than executable markup.","depth":"sunlit","depthScore":26,"depthScoreParts":{"impact":26.4,"likelihood":0,"exploitation":0,"ransomware":0},"changes":[]}