PatchSiren

PatchSiren cyber security CVE debrief

CVE-2026-54395 misp CVE debrief

CVE-2026-54395 is a reflected cross-site scripting (XSS) vulnerability in the MISP (Malware Information Sharing Platform) UiBeta event index view. The vulnerability arises from the improper handling of user-supplied input in the `urlparams` value, which is inserted into an inline JavaScript handler using HTML escaping inside a single-quoted JavaScript string. Due to browser behavior, an attacker can craft a malicious URL that, when opened by a victim using the UiBeta event index, executes arbitrary JavaScript in the victim's browser within the context of the MISP instance. The issue has been addressed by encoding the value as a JavaScript string literal using `json_encode()` before applying HTML escaping at the attribute layer.

Vendor
misp
Product
Unknown
CVSS
MEDIUM 5.3
CISA KEV
Not listed in stored evidence
Original CVE published
2026-06-12
Original CVE updated
2026-06-15
Advisory published
2026-06-12
Advisory updated
2026-06-15

Who should care

Administrators and users of MISP instances should be aware of this vulnerability and take steps to mitigate it. This vulnerability has a CVSS score of 5.3 and is classified as MEDIUM severity.

Technical summary

The vulnerability is caused by inadequate input handling in the UiBeta event index view of MISP. Specifically, the `urlparams` value is not properly sanitized, allowing an attacker to inject malicious JavaScript code. The CVSS vector for this vulnerability is CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X.

Defensive priority

MEDIUM

Recommended defensive actions

  • Apply the patch provided in the MISP GitHub repository [ref-4].
  • Ensure that MISP instances are updated to the latest version.
  • Users should be cautious when clicking on URLs from untrusted sources, especially in the context of the MISP instance.

Evidence notes

The CVE record [cve-org] and NVD detail [nvd] provide additional information about this vulnerability.

Sources and references

Verified primary and authoritative sources

  • CVE-2026-54395 CVE Program record

    Publisher, destination, and source semantics verified

    URL: https://www.cve.org/CVERecord?id=CVE-2026-54395

    CVE Program - Official CVE Program record with source-provided CVE metadata.

  • CVE-2026-54395 NVD vulnerability detail

    Publisher, destination, and source semantics verified

    URL: https://nvd.nist.gov/vuln/detail/CVE-2026-54395

    NIST National Vulnerability Database - Official NIST NVD detail page and source-specific vulnerability assessment.

Supplemental references

  • Source reference

    Unverified legacy reference

    URL: https://github.com/MISP/MISP/commit/b865deb036ca82dab272be260798f562034ba9ae

    5a6e4751-2f3f-4070-9419-94fb35b644e8

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.