---
id: CVE-2026-94277
title: >-
  MISP's galaxy matrix statistics view
  (app/View/Users/statistics_galaxymatrix.ctp) renders the galaxy name directly
  into HTML output via sprintf() without any HTML encoding
summary: >-
  MISP's galaxy matrix statistics view
  (app/View/Users/statistics_galaxymatrix.ctp) renders the galaxy name directly
  into HTML output via sprintf() without any HTML encoding. An authenticated
  user holding the perm_galaxy_editor permission …
severity: medium
cvss: 6.3
cvssVector: 'CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:P/VC:L/VI:L/VA:N/SC:H/SI:H/SA:N'
cwe:
  - CWE-79
vendor: MISP
product: MISP
affected:
  - MISP < 2.5.47
published: '2026-09-21'
updated: '2026-09-21'
sourceUpdated: '2026-09-21T12:17:28.060'
source: NVD
sourceUrl: 'https://nvd.nist.gov/vuln/detail/CVE-2026-94277'
references:
  - url: 'https://github.com/MISP/MISP/commit/6b7637bf4'
    label: 5a6e4751-2f3f-4070-9419-94fb35b644e8
tags:
  - nvd
  - cve.org
ssvc:
  exploitation: none
  automatable: 'no'
  technicalImpact: partial
  timestamp: '2026-09-21T11:15:58.920644Z'
cvssSource: cna
ingestedAt: '2026-09-21T09:34:37.181Z'
epss: 0.00396
epssPercentile: 0.31099
---

## Overview

MISP's galaxy matrix statistics view (app/View/Users/statistics_galaxymatrix.ctp) renders the galaxy name directly into HTML output via sprintf() without any HTML encoding. An authenticated user holding the perm_galaxy_editor permission can create or modify a galaxy whose name contains arbitrary HTML or JavaScript markup. Because the value is interpolated verbatim into the page, any user who subsequently opens the galaxy matrix statistics page will have the embedded script executed in their browser context. This enables session hijacking, credential theft, data exfiltration, or the performance of arbitrary actions on behalf of the victim within the MISP application.

Version affected: <2.5.47

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.