CVE-2026-54395Disclosure

LOWCVSS 5.3 · MEDIUM

Signal is active with 2 mentions in latest observed window

Immediate actions

Track advisory updates for patch or workaround availability

Recommended action window: Monitor and triage in normal cycle

NVD description

MISP contains a reflected cross-site scripting vulnerability in the UiBeta event index view. The urlparams value is inserted into an inline JavaScript handler using HTML escaping inside a single-quoted JavaScript string. Because browsers HTML-decode attribute values before JavaScript parsing, a crafted searcheventinfo value can restore encoded quote characters and break out of the JavaScript string. An attacker could craft a malicious URL that, when opened by a victim using the UiBeta event index, executes arbitrary JavaScript in the victim’s browser in the context of the MISP instance. The issue is fixed by encoding the value as a JavaScript string literal with json_encode() before applying HTML escaping at the attribute layer.

Back to dashboard

0.0/ 10 priority

Sources & remediation

Other references

https://github.com/MISP/MISP/commit/b865deb036ca82dab272be260798f562034ba9ae

Weakness type (CWE)

CWE-79

Priority

LOW

Exploitation

NONE

PoC

NONE

Patch

NONE

Momentum

NONE

Threat summary

2 mentions across 1 observed day

What's happening

Technical details provided in 2 signals
Disclosure: 2 classified signals
2 total mentions across 1 day

Deep dive

Activity timeline2 mentions / 1d

Signal classification1 categories

Disclosure

2100.0%

Referenced assets2 URLs

By indicator

Full discourse2 posts

Infoflowcloud@infoflowcloud137d
Disclosure
🚨*CVE* CVE-2026-54395 MISP contains a reflected cross-site scripting vulnerability in the UiBeta event index view. The urlparams value is inserted into an inline JavaScript handler using H… https://www.cve.org/CVERecord?id=CVE-2026-54395 ----- Traducción: CVE-2026-54395 MIS… http://infoflow.cloud`
Post summary
A disclosure of CVE-2026-54395, a reflected XSS flaw in MISP’s UiBeta event index view, is presented without mention of PoC, exploitation, patch, or false‑positive claims.
0000036
79 followersView on X
CVE@CVEnew137d
Disclosure
CVE-2026-54395 MISP contains a reflected cross-site scripting vulnerability in the UiBeta event index view. The urlparams value is inserted into an inline JavaScript handler using H… https://www.cve.org/CVERecord?id=CVE-2026-54395
Post summary
CVE-2026-54395 is a reflected XSS vulnerability in MISP’s UiBeta event index view, where the urlparams value is injected into an inline JavaScript handler. No PoC, exploit code, or patch information is provided.
00000241
57.6K followersView on X

Explore more

Back to dashboard