PatchSiren

PatchSiren cyber security CVE debrief

CVE-2026-54395 misp CVE debrief

CVE-2026-54395 is a reflected cross-site scripting (XSS) vulnerability in the MISP (Malware Information Sharing Platform) UiBeta event index view. The vulnerability arises from the improper handling of user-supplied input in the `urlparams` value, which is inserted into an inline JavaScript handler using HTML escaping inside a single-quoted JavaScript string. Due to browser behavior, an attacker can craft a malicious URL that, when opened by a victim using the UiBeta event index, executes arbitrary JavaScript in the victim's browser within the context of the MISP instance. The issue has been addressed by encoding the value as a JavaScript string literal using `json_encode()` before applying HTML escaping at the attribute layer.

Vendor
misp
Product
Unknown
CVSS
MEDIUM 5.3
CISA KEV
Not listed in stored evidence
Original CVE published
2026-06-12
Original CVE updated
2026-06-12
Advisory published
2026-06-12
Advisory updated
2026-06-12

Who should care

Administrators and users of MISP instances should be aware of this vulnerability and take steps to mitigate it. This vulnerability has a CVSS score of 5.3 and is classified as MEDIUM severity.

Technical summary

The vulnerability is caused by inadequate input handling in the UiBeta event index view of MISP. Specifically, the `urlparams` value is not properly sanitized, allowing an attacker to inject malicious JavaScript code. The CVSS vector for this vulnerability is CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X.

Defensive priority

MEDIUM

Recommended defensive actions

  • Apply the patch provided in the MISP GitHub repository [ref-4].
  • Ensure that MISP instances are updated to the latest version.
  • Users should be cautious when clicking on URLs from untrusted sources, especially in the context of the MISP instance.

Evidence notes

The CVE record [cve-org] and NVD detail [nvd] provide additional information about this vulnerability.

Official resources

CVE-2026-54395 was published on 2026-06-12T21:16:25.293Z and has not been modified since then.