---
id: CVE-2026-103321
title: >-
  MISP contains a stored cross-site script (XSS) vulnerability in the event
  graph preview feature.


  The event graph preview image field was accepted and stored without
  server-side validation
summary: >-
  MISP contains a stored cross-site script (XSS) vulnerability in the event
  graph preview feature.


  The event graph preview image field was accepted and stored without
  server-side validation. On the client side, the stored value was render…
severity: high
cvss: 8.3
cvssVector: 'CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:P/VC:N/VI:H/VA:N/SC:H/SI:H/SA:N'
cwe:
  - CWE-20
  - CWE-79
vendor: MISP
product: MISP
affected:
  - MISP < 2.5.48
published: '2026-09-30'
updated: '2026-09-30'
sourceUpdated: '2026-09-30T13:17:18.603'
source: NVD
sourceUrl: 'https://nvd.nist.gov/vuln/detail/CVE-2026-103321'
references:
  - url: 'https://github.com/MISP/MISP/commit/92c7ccc43'
    label: 5a6e4751-2f3f-4070-9419-94fb35b644e8
tags:
  - nvd
  - cve.org
ssvc:
  exploitation: none
  automatable: 'no'
  technicalImpact: partial
  timestamp: '2026-09-30T12:44:13.205587Z'
cvssSource: cna
ingestedAt: '2026-09-30T13:03:51.967Z'
---

## Overview

MISP contains a stored cross-site script (XSS) vulnerability in the event graph preview feature.

The event graph preview image field was accepted and stored without server-side validation. On the client side, the stored value was rendered into an HTML img element's src attribute via string concatenation, allowing a crafted value to break out of the attribute context and inject arbitrary script.

Preconditions:

- An authenticated MISP user with the ability to create or modify an event graph entry.

- A second user (the victim) who views the event graph and triggers the preview popover.

Impact:

- Execution of arbitrary JavaScript in the victim's browser within the MISP application context.

- Potential theft of session tokens, cookies, or sensitive data accessible to the victim's browser.

- Potential for performing actions on behalf of the victim within the MISP application.

Affected: MISP versions prior to the fix (commit applied after v2.5.48).

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.