CVE-2026-93296 misp CVE debrief

Who should care

Defenders responsible for MISP instances, especially those using the Overmind theme, should assess exposure and prioritize patching. They should also monitor for suspicious activity on dashboards and ensure proper input validation and output encoding. Roles include security administrators, incident responders, and system administrators.

Why it matters

The CVE-2026-93296 vulnerability in MISP's Overmind theme allows an attacker to inject malicious markup, potentially leading to session hijacking, data exfiltration, or arbitrary actions. Defenders should prioritize verifying and patching MISP instances, monitoring for suspicious activity, and ensuring proper input validation and output encoding. Evidence is limited to CVE and NVD records, with no specific versions, exploitation, impact, or remediation details beyond patching.

• Session hijacking or cookie tampering
• Data exfiltration or unauthorized data access
• Arbitrary actions performed on behalf of the victim
• Verification of patching and input validation

Technical summary

The MISP application contains a stored cross-site scripting (XSS) vulnerability in the Overmind theme's statistics views. The event General card and the server/feed preview card constructed donut chart legend labels by directly concatenating object name or category keys into an innerHTML string without HTML-encoding. This allows an attacker with low-level authenticated access to create or rename an object whose name is rendered in the legend, potentially leading to session hijacking, data exfiltration, or arbitrary actions performed on behalf of the victim when another user views the affected Overmind dashboard.

Defensive priority

Defenders should prioritize verifying and patching MISP instances using the Overmind theme, especially those with user-controllable object names or categories. They should also monitor for suspicious activity on dashboards and ensure proper input validation and output encoding.

Recommended defensive actions

• Verify and apply patches for MISP instances using the Overmind theme
• Monitor for suspicious activity on dashboards
• Ensure proper input validation and output encoding for user-controllable object names and categories
• Review and update MISP configurations to prevent exploitation
• Confirm whether affected MISP instances exist in managed environments and assign an owner for follow-up
• Review compensating controls for exposed MISP systems while remediation is scheduled and verified
• Track exceptions, retest remediated MISP assets, and close the item only after evidence is documented

Evidence notes

The CVE record and NVD entry provide details on the vulnerability, including its description, CVSS score, and affected components. However, the corpus does not establish specific versions, exploitation, impact, or remediation beyond patching.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.