CVE-2026-94277 MISP CVE debrief

Who should care

Defenders responsible for MISP instances, particularly those with users holding the perm_galaxy_editor permission, should assess exposure and apply remediation to prevent session hijacking and arbitrary actions within the application.

Why it matters

CVE-2026-94277 is a medium-severity vulnerability in MISP's galaxy matrix statistics view that allows an authenticated user to execute arbitrary JavaScript, enabling session hijacking, credential theft, data exfiltration, or arbitrary actions within the application. Defenders should prioritize verifying exposure and applying remediation, as the vulnerability can lead to significant consequences within the MISP application. The affected version is <2.5.47, and remediation involves upgrading to version 2.5.47 or later. Evidence is limited to the CVE record and NVD entry, which provide details on the vulnerability but do not establish specific exploitation or impact instances.

• Session hijacking within the MISP application
• Credential theft through embedded JavaScript
• Data exfiltration via executed scripts
• Arbitrary actions on behalf of the victim user

Technical summary

The MISP galaxy matrix statistics view renders the galaxy name directly into HTML output via sprintf() without any HTML encoding. An authenticated user holding the perm_galaxy_editor permission can create or modify a galaxy whose name contains arbitrary HTML or JavaScript markup. This enables session hijacking, credential theft, data exfiltration, or the performance of arbitrary actions on behalf of the victim within the MISP application.

Defensive priority

Defenders should prioritize verifying exposure and applying remediation for this vulnerability, as it can lead to session hijacking and arbitrary actions within the MISP application.

Recommended defensive actions

• Verify exposure by checking if the MISP instance is running a version less than 2.5.47
• Apply remediation by upgrading to version 2.5.47 or later
• Monitor for suspicious activity on the galaxy matrix statistics page
• Restrict access to the perm_galaxy_editor permission
• Review compensating controls for exposed systems while remediation is scheduled and verified
• Check relevant monitoring, detection, and logs for exposed assets that need extra review
• Track exceptions, retest remediated assets, and close the item only after evidence is documented

Evidence notes

The CVE record and NVD entry provide details on the vulnerability, including its description, affected version, and CVSS score. However, the corpus does not establish specific exploitation or impact instances.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.