CVE-2026-94277

LOWCVSS 6.3 · MEDIUM

Immediate actions

Track advisory updates for patch or workaround availability

Recommended action window: Monitor and triage in normal cycle

NVD description

MISP's galaxy matrix statistics view (app/View/Users/statistics_galaxymatrix.ctp) renders the galaxy name directly into HTML output via sprintf() without any HTML encoding. An authenticated user holding the perm_galaxy_editor permission can create or modify a galaxy whose name contains arbitrary HTML or JavaScript markup. Because the value is interpolated verbatim into the page, any user who subsequently opens the galaxy matrix statistics page will have the embedded script executed in their browser context. This enables session hijacking, credential theft, data exfiltration, or the performance of arbitrary actions on behalf of the victim within the MISP application. Version affected: <2.5.47

Back to dashboard

0.0/ 10 priority

Sources & remediation

Other references

https://github.com/MISP/MISP/commit/6b7637bf4

Weakness type (CWE)

CWE-79

Priority

LOW

Exploitation

NONE

PoC

NONE

Patch

NONE

Momentum

NONE

Deep dive

Full discourse1 post

Hugo | DevOps | Cybersecurity@HugoValters20h
CVE-2026-94277 MISP stored XSS, CVSS 5.4. Galaxy editor perm users can inject script into the statistics page, hitting anyone who opens it. Patch under review, so limit galaxy editing rights for now. #CVE #infosec #MISP https://www.valtersit.com/cve/CVE-2026-94277/ #MISP #CVEALERT #CVE #infosec #Linux #XSS #valtersit #snippet #SysAdmin #cybersecurity #devsecops #devops #developer #100daysofcode #git #github #gitlab #redteam #blueteam #ethicalhacker #cybersecurityawareness #cybersecuritynews #cybersecuritytips #python #hacker #kali #ubuntu #debian #docker
0000042
1.1K followersView on X

Explore more

Back to dashboard