CVE-2026-54395: Misp

Medium severity, CVSS 5.3. EPSS: 0.4% chance of exploitation in the next 30 days.

MISP contains a reflected cross-site scripting vulnerability in the UiBeta event index view. The urlparams value is inserted into an inline JavaScript handler using HTML escaping inside a single-quoted JavaScript string. Because browsers HTML-decode attribute values before JavaScript parsing, a crafted searcheventinfo value can restore encoded quote characters and break out of the JavaScript string. An attacker could craft a malicious URL that, when opened by a victim using the UiBeta event index, executes arbitrary JavaScript in the victim’s browser in the context of the MISP instance. The issue is fixed by encoding the value as a JavaScript string literal with json_encode() before applying HTML escaping at the attribute layer.

Affected products

• Misp Misp: before 2.5.40 (fixed in 2.5.40)

Published 2026-06-12. Last modified 2026-06-17.