---
id: CVE-2026-95661
title: >-
  MISP contains a reflected cross-site scripting (XSS) vulnerability in the
  attribute histogram view
summary: >-
  MISP contains a reflected cross-site scripting (XSS) vulnerability in the
  attribute histogram view. The $selectedTypes variable, which is derived from
  the URL path segment , was interpolated directly into a JavaScript array
  literal insid…
severity: medium
cvss: 5.1
cvssVector: 'CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:L/VI:L/VA:N/SC:L/SI:L/SA:N'
cwe:
  - CWE-79
vendor: MISP
product: MISP
affected:
  - MISP < 2.5.47
published: '2026-09-22'
updated: '2026-09-22'
sourceUpdated: '2026-09-22T16:18:19.497'
source: NVD
sourceUrl: 'https://nvd.nist.gov/vuln/detail/CVE-2026-95661'
references:
  - url: 'https://github.com/MISP/MISP/commit/95b8f21f6'
    label: 5a6e4751-2f3f-4070-9419-94fb35b644e8
tags:
  - nvd
  - cve.org
ssvc:
  exploitation: none
  automatable: 'no'
  technicalImpact: partial
  timestamp: '2026-09-22T15:33:57.327364Z'
cvssSource: cna
ingestedAt: '2026-09-22T13:03:40.034Z'
epss: 0.00436
epssPercentile: 0.35238
---

## Overview

MISP contains a reflected cross-site scripting (XSS) vulnerability in the attribute histogram view. The $selectedTypes variable, which is derived from the URL path segment , was interpolated directly into a JavaScript array literal inside an onClick HTML attribute without any encoding or escaping. An attacker who can cause an authenticated MISP user to visit a crafted URL containing a malicious type value can execute arbitrary JavaScript in the victim's browser within the MISP application origin.

Successful exploitation allows the attacker to read session cookies, perform actions on behalf of the victim, or exfiltrate sensitive data accessible from the MISP interface. 

The vulnerability requires the victim to be authenticated and to actively navigate to the attacker-supplied URL.

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.