---
id: CVE-2026-112184
title: >-
  MISP Workflow Module: Reflected XSS via Unescaped misp-modules Parameter Names
  in Form Labels
summary: >-
  MISP contains a reflected cross-site scripting (XSS) vulnerability in the
  workflow module interface. Parameter names returned by the misp-modules
  service are rendered as raw HTML form labels on the workflow module page
  without output enc…
severity: medium
cvss: 4.8
cvssVector: 'CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:A/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N'
cvssSource: cna
cwe:
  - CWE-79
vendor: MISP
product: MISP
affected:
  - MISP < 2.5.48
published: '2026-10-19'
updated: '2026-10-19'
sourceUpdated: '2026-10-19T09:19:45.056Z'
source: CVEORG
sourceUrl: 'https://www.cve.org/CVERecord?id=CVE-2026-112184'
references:
  - url: 'https://github.com/MISP/MISP/commit/813a48b2b'
    label: Security patch
tags:
  - cve.org
ingestedAt: '2026-10-19T11:23:01.730Z'
---

## Overview

MISP contains a reflected cross-site scripting (XSS) vulnerability in the workflow module interface. Parameter names returned by the misp-modules service are rendered as raw HTML form labels on the workflow module page without output encoding. An attacker who can influence the parameter names reported by the misp-modules service can inject arbitrary HTML or JavaScript that executes in the context of an authenticated MISP user's browser.

Preconditions:

- The attacker must be able to control or influence parameter names reported by the misp-modules service.

- A victim must be authenticated and view the affected workflow module page.

Impact:

- Execution of arbitrary JavaScript in the victim's browser session.

- Potential theft of session tokens, manipulation of the MISP interface, or initiation of unauthorized actions on behalf of the victim.

Affected versions: <2.5.48.

## Affected

- `MISP < 2.5.48`

## Remediation

The fix applies HTML output encoding (the h() helper) to the parameter name before it is used as a form label, ensuring that any HTML metacharacters in the value are neutralized and rendered as inert text rather than executable markup.