CVE-2026-94277 (GCVE-0-2026-94277)
Vulnerability from cvelistv5 – Published: 2026-09-21 09:25 – Updated: 2026-09-21 11:16
VLAI
EPSS
VEX
Title
Stored Cross-Site Scripting in MISP Galaxy Matrix Statistics via Unescaped Galaxy Name
Summary
MISP's galaxy matrix statistics view (app/View/Users/statistics_galaxymatrix.ctp) renders the galaxy name directly into HTML output via sprintf() without any HTML encoding. An authenticated user holding the perm_galaxy_editor permission can create or modify a galaxy whose name contains arbitrary HTML or JavaScript markup. Because the value is interpolated verbatim into the page, any user who subsequently opens the galaxy matrix statistics page will have the embedded script executed in their browser context. This enables session hijacking, credential theft, data exfiltration, or the performance of arbitrary actions on behalf of the victim within the MISP application.
Version affected: <2.5.47
Severity
SSVC
Exploitation: none
Automatable: no
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-09-21 11:15 UTC
CWE
- CWE-79 - Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
Assigner
References
1 reference
| URL | Tags |
|---|---|
| https://github.com/MISP/MISP/commit/6b7637bf4 | patch |
Impacted products
GCVE extensions
AI-generated
Confidence: high
Model
qwen3.8:27b
advisory
bcp-05-x-01bcp-05-x-02
AI involvement
GCVE-BCP-05-X-01
Draft vulnerability metadata was generated from a git-format patch using an Ollama-hosted language model. Human validation is required before publication.
ai-computer-assisted:llm-generatedai-computer-assisted:classification
| Model | Source | Identifier |
|---|---|---|
| qwen3.8:27b | ollama | qwen3.8:27b |
Patch provenance
GCVE-BCP-05-X-02
- Generator
-
patch2vuln.pyon 2026-09-21 08:45 - Model
qwen3.8:27b- Input
-
https://github.com/MISP/MISP/commit/6b7637bf4.patch
c87b2f367c3c… - Confidence
- high
| Commit | Subject | Patch SHA-256 |
|---|---|---|
6b7637bf4663
|
fix: [security] Escape the galaxy name in the statistics | c87b2f367c3c… |
Fix summary
The fix applies CakePHP's h() HTML-encoding function to the $galaxyName variable before it is passed to sprintf() for HTML output, ensuring that any special characters (angle brackets, quotes, etc.) in the galaxy name are percent-encoded and rendered as inert text rather than executable markup.
Patch summary
In app/View/Users/statistics_galaxymatrix.ctp, the single line echo sprintf(__('A heatmap showing the usage of %s.'), $galaxyName) was changed to echo sprintf(__('A heatmap showing the usage of %s.'), h($galaxyName)), wrapping the user-controlled variable with CakePHP's HTML-encoding helper before interpolation into the HTML document.
CVSS rationale
AV:N: The attack is delivered over the network via the MISP web interface. AC:L: Creating a galaxy with a script-bearing name requires no special timing or race condition. AT:N: No additional attack complexity beyond normal application use. PR:L: The attacker needs an authenticated account with perm_galaxy_editor, a low-privilege role. UI:P: The victim must visit the galaxy matrix statistics page, a legitimate page they may open during normal work; no specific tricked action (click, download) is required. VC/VI/VA:N: The MISP server itself suffers no direct confidentiality, integrity, or availability loss; the payload executes client-side. SC:H: The victim's browser session is fully compromised (cookies, tokens, in-page data). SI:H: The attacker can perform arbitrary actions in the victim's authenticated session. SA:N: No denial-of-service impact on the victim's browser. Assumption: perm_galaxy_editor is a low-privilege role (PR:L); if it requires higher clearance, PR could be H.
Weakness rationale
- CWE-79 The root cause is the direct interpolation of a user-controlled string (galaxy name) into an HTML context without output encoding, allowing script injection. This is a textbook stored XSS (CWE-79).
Assumptions to verify
- perm_galaxy_editor is treated as a low-privilege role (PR:L); if it requires elevated clearance the PR metric should be raised to H.
- The affected version boundary is inferred from the tag v2.5.47 (47 commits after the fix commit); no explicit 'fixed in' version is stated in the patch.
- UI:P assumes the victim voluntarily navigates to the statistics page as part of normal workflow rather than being lured by a crafted link (which would be UI:A).
Model comparison
Selected qwen3.8:27b
by deterministic-consensus-v1
The selected result is closest to model consensus; this heuristic does not establish factual correctness and human review remains required.
| Model | Score | Agreement | Confidence | Assumptions |
|---|---|---|---|---|
qwen3.8:27b |
8 | 9 | high | 3 |
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-94277",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-09-21T11:15:58.920644Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-09-21T11:16:10.434Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"modules": [
"app/View/Users/statistics_galaxymatrix.ctp"
],
"product": "MISP",
"programFiles": [
"app/View/Users/statistics_galaxymatrix.ctp"
],
"repo": "https://github.com/MISP/MISP",
"vendor": "MISP",
"versions": [
{
"lessThan": "2.5.47",
"status": "affected",
"version": "0",
"versionType": "semver"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "reporter",
"value": "Jeroen Pinoy"
},
{
"lang": "en",
"type": "remediation developer",
"value": "iglocska"
},
{
"lang": "en",
"type": "remediation developer",
"value": "Claude Opus 4.8"
}
],
"descriptions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "\u003cp\u003eMISP\u0027s galaxy matrix statistics view (app/View/Users/statistics_galaxymatrix.ctp) renders the galaxy name directly into HTML output via sprintf() without any HTML encoding. An authenticated user holding the perm_galaxy_editor permission can create or modify a galaxy whose name contains arbitrary HTML or JavaScript markup. Because the value is interpolated verbatim into the page, any user who subsequently opens the galaxy matrix statistics page will have the embedded script executed in their browser context. This enables session hijacking, credential theft, data exfiltration, or the performance of arbitrary actions on behalf of the victim within the MISP application.\u003c/p\u003e\u003cp\u003eVersion affected: \u0026lt;2.5.47\u003c/p\u003e"
}
],
"value": "MISP\u0027s galaxy matrix statistics view (app/View/Users/statistics_galaxymatrix.ctp) renders the galaxy name directly into HTML output via sprintf() without any HTML encoding. An authenticated user holding the perm_galaxy_editor permission can create or modify a galaxy whose name contains arbitrary HTML or JavaScript markup. Because the value is interpolated verbatim into the page, any user who subsequently opens the galaxy matrix statistics page will have the embedded script executed in their browser context. This enables session hijacking, credential theft, data exfiltration, or the performance of arbitrary actions on behalf of the victim within the MISP application.\n\nVersion affected: \u003c2.5.47"
}
],
"impacts": [
{
"capecId": "CAPEC-63",
"descriptions": [
{
"lang": "en",
"value": "CAPEC-63 Cross-Site Scripting (XSS)"
}
]
}
],
"metrics": [
{
"cvssV4_0": {
"Automatable": "NOT_DEFINED",
"Recovery": "NOT_DEFINED",
"Safety": "NOT_DEFINED",
"attackComplexity": "LOW",
"attackRequirements": "NONE",
"attackVector": "NETWORK",
"baseScore": 6.3,
"baseSeverity": "MEDIUM",
"privilegesRequired": "LOW",
"providerUrgency": "NOT_DEFINED",
"subAvailabilityImpact": "NONE",
"subConfidentialityImpact": "HIGH",
"subIntegrityImpact": "HIGH",
"userInteraction": "PASSIVE",
"valueDensity": "NOT_DEFINED",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:P/VC:L/VI:L/VA:N/SC:H/SI:H/SA:N",
"version": "4.0",
"vulnAvailabilityImpact": "NONE",
"vulnConfidentialityImpact": "LOW",
"vulnIntegrityImpact": "LOW",
"vulnerabilityResponseEffort": "NOT_DEFINED"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-79",
"description": "CWE-79 Improper Neutralization of Input During Web Page Generation (\u0027Cross-site Scripting\u0027)",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-09-21T09:25:04.966Z",
"orgId": "5a6e4751-2f3f-4070-9419-94fb35b644e8",
"shortName": "CIRCL"
},
"references": [
{
"name": "Security patch",
"tags": [
"patch"
],
"url": "https://github.com/MISP/MISP/commit/6b7637bf4"
}
],
"solutions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "\u003cp\u003eThe fix applies CakePHP\u0027s h() HTML-encoding function to the $galaxyName variable before it is passed to sprintf() for HTML output, ensuring that any special characters (angle brackets, quotes, etc.) in the galaxy name are percent-encoded and rendered as inert text rather than executable markup.\u003c/p\u003e"
}
],
"value": "The fix applies CakePHP\u0027s h() HTML-encoding function to the $galaxyName variable before it is passed to sprintf() for HTML output, ensuring that any special characters (angle brackets, quotes, etc.) in the galaxy name are percent-encoded and rendered as inert text rather than executable markup."
}
],
"title": "Stored Cross-Site Scripting in MISP Galaxy Matrix Statistics via Unescaped Galaxy Name",
"x_gcve": [
{
"extensions": {
"bcp-05-x-01": {
"ai_annotations": [
{
"ai_level": "generated",
"description": "Draft vulnerability metadata was generated from a git-format patch using an Ollama-hosted language model. Human validation is required before publication.",
"gna_source": 1,
"models": [
{
"gna_source": 1,
"identifier": "qwen3.8:27b",
"name": "qwen3.8:27b",
"source": "ollama"
}
],
"review_status": "review",
"scope": "record",
"tags": [
"ai-computer-assisted:llm-generated",
"ai-computer-assisted:classification"
]
}
]
},
"bcp-05-x-02": {
"x_patch2vuln": {
"assumptions": [
"perm_galaxy_editor is treated as a low-privilege role (PR:L); if it requires elevated clearance the PR metric should be raised to H.",
"The affected version boundary is inferred from the tag v2.5.47 (47 commits after the fix commit); no explicit \u0027fixed in\u0027 version is stated in the patch.",
"UI:P assumes the victim voluntarily navigates to the statistics page as part of normal workflow rather than being lured by a crafted link (which would be UI:A)."
],
"commit": "6b7637bf46633e880d8fb9900fa69986eabfc82e",
"confidence": "high",
"credits": [
{
"lang": "en",
"type": "reporter",
"value": "Jeroen Pinoy"
},
{
"lang": "en",
"type": "remediation developer",
"value": "iglocska"
},
{
"lang": "en",
"type": "remediation developer",
"value": "Claude Opus 4.8"
}
],
"cvssRationale": "AV:N: The attack is delivered over the network via the MISP web interface. AC:L: Creating a galaxy with a script-bearing name requires no special timing or race condition. AT:N: No additional attack complexity beyond normal application use. PR:L: The attacker needs an authenticated account with perm_galaxy_editor, a low-privilege role. UI:P: The victim must visit the galaxy matrix statistics page, a legitimate page they may open during normal work; no specific tricked action (click, download) is required. VC/VI/VA:N: The MISP server itself suffers no direct confidentiality, integrity, or availability loss; the payload executes client-side. SC:H: The victim\u0027s browser session is fully compromised (cookies, tokens, in-page data). SI:H: The attacker can perform arbitrary actions in the victim\u0027s authenticated session. SA:N: No denial-of-service impact on the victim\u0027s browser. Assumption: perm_galaxy_editor is a low-privilege role (PR:L); if it requires higher clearance, PR could be H.",
"draft": false,
"fixSummary": "The fix applies CakePHP\u0027s h() HTML-encoding function to the $galaxyName variable before it is passed to sprintf() for HTML output, ensuring that any special characters (angle brackets, quotes, etc.) in the galaxy name are percent-encoded and rendered as inert text rather than executable markup.",
"generatedAt": "2026-09-21T08:45:23.903680Z",
"generator": "patch2vuln.py",
"model": "qwen3.8:27b",
"modelComparison": {
"rankings": [
{
"agreementScore": 9,
"assumptionCount": 3,
"confidence": "high",
"model": "qwen3.8:27b",
"score": 8
}
],
"selectedModel": "qwen3.8:27b",
"selectionMethod": "deterministic-consensus-v1",
"selectionNotice": "The selected result is closest to model consensus; this heuristic does not establish factual correctness and human review remains required."
},
"patchSha256": "c87b2f367c3cb449d92ad781865f48beeed01298a6c2a91d9f5234e67ab2930d",
"patchSummary": "In app/View/Users/statistics_galaxymatrix.ctp, the single line echo sprintf(__(\u0027A heatmap showing the usage of %s.\u0027), $galaxyName) was changed to echo sprintf(__(\u0027A heatmap showing the usage of %s.\u0027), h($galaxyName)), wrapping the user-controlled variable with CakePHP\u0027s HTML-encoding helper before interpolation into the HTML document.",
"patchTruncated": false,
"patches": [
{
"commit": "6b7637bf46633e880d8fb9900fa69986eabfc82e",
"patchSha256": "c87b2f367c3cb449d92ad781865f48beeed01298a6c2a91d9f5234e67ab2930d",
"source": "https://github.com/MISP/MISP/commit/6b7637bf4.patch",
"sourceUrl": "https://github.com/MISP/MISP/commit/6b7637bf4.patch",
"subject": "fix: [security] Escape the galaxy name in the statistics"
}
],
"source": "https://github.com/MISP/MISP/commit/6b7637bf4.patch",
"subject": "fix: [security] Escape the galaxy name in the statistics",
"tagVersionBoundary": {
"commits_after_fix": 47,
"repository": "https://github.com/MISP/MISP",
"tag": "v2.5.47",
"version": "2.5.47",
"version_type": "semver"
},
"weaknessRationale": [
{
"cweId": "CWE-79",
"rationale": "The root cause is the direct interpolation of a user-controlled string (galaxy name) into an HTML context without output encoding, allowing script injection. This is a textbook stored XSS (CWE-79)."
}
]
}
}
},
"recordType": "advisory",
"vulnId": "GCVE-1-2026-20155"
}
]
}
},
"cveMetadata": {
"assignerOrgId": "5a6e4751-2f3f-4070-9419-94fb35b644e8",
"assignerShortName": "CIRCL",
"cveId": "CVE-2026-94277",
"datePublished": "2026-09-21T09:25:04.966Z",
"dateReserved": "2026-09-21T09:25:02.306Z",
"dateUpdated": "2026-09-21T11:16:10.434Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2",
"vulnerability-lookup:meta": {
"nvd": {
"cve": {
"affected": [
{
"affectedData": [
{
"modules": [
"app/View/Users/statistics_galaxymatrix.ctp"
],
"product": "MISP",
"programFiles": [
"app/View/Users/statistics_galaxymatrix.ctp"
],
"repo": "https://github.com/MISP/MISP",
"vendor": "MISP",
"versions": [
{
"lessThan": "2.5.47",
"status": "affected",
"version": "0",
"versionType": "semver"
}
]
}
],
"source": "5a6e4751-2f3f-4070-9419-94fb35b644e8"
}
],
"cveTags": [],
"descriptions": [
{
"lang": "en",
"value": "MISP\u0027s galaxy matrix statistics view (app/View/Users/statistics_galaxymatrix.ctp) renders the galaxy name directly into HTML output via sprintf() without any HTML encoding. An authenticated user holding the perm_galaxy_editor permission can create or modify a galaxy whose name contains arbitrary HTML or JavaScript markup. Because the value is interpolated verbatim into the page, any user who subsequently opens the galaxy matrix statistics page will have the embedded script executed in their browser context. This enables session hijacking, credential theft, data exfiltration, or the performance of arbitrary actions on behalf of the victim within the MISP application.\n\nVersion affected: \u003c2.5.47"
}
],
"id": "CVE-2026-94277",
"lastModified": "2026-09-21T12:17:28.060",
"metrics": {
"cvssMetricV40": [
{
"cvssData": {
"Automatable": "NOT_DEFINED",
"Recovery": "NOT_DEFINED",
"Safety": "NOT_DEFINED",
"attackComplexity": "LOW",
"attackRequirements": "NONE",
"attackVector": "NETWORK",
"availabilityRequirement": "NOT_DEFINED",
"baseScore": 6.3,
"baseSeverity": "MEDIUM",
"confidentialityRequirement": "NOT_DEFINED",
"exploitMaturity": "NOT_DEFINED",
"integrityRequirement": "NOT_DEFINED",
"modifiedAttackComplexity": "NOT_DEFINED",
"modifiedAttackRequirements": "NOT_DEFINED",
"modifiedAttackVector": "NOT_DEFINED",
"modifiedPrivilegesRequired": "NOT_DEFINED",
"modifiedSubAvailabilityImpact": "NOT_DEFINED",
"modifiedSubConfidentialityImpact": "NOT_DEFINED",
"modifiedSubIntegrityImpact": "NOT_DEFINED",
"modifiedUserInteraction": "NOT_DEFINED",
"modifiedVulnAvailabilityImpact": "NOT_DEFINED",
"modifiedVulnConfidentialityImpact": "NOT_DEFINED",
"modifiedVulnIntegrityImpact": "NOT_DEFINED",
"privilegesRequired": "LOW",
"providerUrgency": "NOT_DEFINED",
"subAvailabilityImpact": "NONE",
"subConfidentialityImpact": "HIGH",
"subIntegrityImpact": "HIGH",
"userInteraction": "PASSIVE",
"valueDensity": "NOT_DEFINED",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:P/VC:L/VI:L/VA:N/SC:H/SI:H/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X",
"version": "4.0",
"vulnAvailabilityImpact": "NONE",
"vulnConfidentialityImpact": "LOW",
"vulnIntegrityImpact": "LOW",
"vulnerabilityResponseEffort": "NOT_DEFINED"
},
"source": "5a6e4751-2f3f-4070-9419-94fb35b644e8",
"type": "Secondary"
}
],
"ssvcV203": [
{
"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"ssvcData": {
"id": "CVE-2026-94277",
"options": [
{
"exploitation": "none"
},
{
"automatable": "no"
},
{
"technicalImpact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-09-21T11:15:58.920644Z",
"version": "2.0.3"
}
}
]
},
"published": "2026-09-21T10:17:17.570",
"references": [
{
"source": "5a6e4751-2f3f-4070-9419-94fb35b644e8",
"url": "https://github.com/MISP/MISP/commit/6b7637bf4"
}
],
"sourceIdentifier": "5a6e4751-2f3f-4070-9419-94fb35b644e8",
"vulnStatus": "Deferred",
"weaknesses": [
{
"description": [
{
"lang": "en",
"value": "CWE-79"
}
],
"source": "5a6e4751-2f3f-4070-9419-94fb35b644e8",
"type": "Secondary"
}
]
}
},
"vulnrichment": {
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-94277",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-09-21T11:15:58.920644Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-09-21T11:16:05.834Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"modules": [
"app/View/Users/statistics_galaxymatrix.ctp"
],
"product": "MISP",
"programFiles": [
"app/View/Users/statistics_galaxymatrix.ctp"
],
"repo": "https://github.com/MISP/MISP",
"vendor": "MISP",
"versions": [
{
"lessThan": "2.5.47",
"status": "affected",
"version": "0",
"versionType": "semver"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "reporter",
"value": "Jeroen Pinoy"
},
{
"lang": "en",
"type": "remediation developer",
"value": "iglocska"
},
{
"lang": "en",
"type": "remediation developer",
"value": "Claude Opus 4.8"
}
],
"descriptions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "\u003cp\u003eMISP\u0027s galaxy matrix statistics view (app/View/Users/statistics_galaxymatrix.ctp) renders the galaxy name directly into HTML output via sprintf() without any HTML encoding. An authenticated user holding the perm_galaxy_editor permission can create or modify a galaxy whose name contains arbitrary HTML or JavaScript markup. Because the value is interpolated verbatim into the page, any user who subsequently opens the galaxy matrix statistics page will have the embedded script executed in their browser context. This enables session hijacking, credential theft, data exfiltration, or the performance of arbitrary actions on behalf of the victim within the MISP application.\u003c/p\u003e\u003cp\u003eVersion affected: \u0026lt;2.5.47\u003c/p\u003e"
}
],
"value": "MISP\u0027s galaxy matrix statistics view (app/View/Users/statistics_galaxymatrix.ctp) renders the galaxy name directly into HTML output via sprintf() without any HTML encoding. An authenticated user holding the perm_galaxy_editor permission can create or modify a galaxy whose name contains arbitrary HTML or JavaScript markup. Because the value is interpolated verbatim into the page, any user who subsequently opens the galaxy matrix statistics page will have the embedded script executed in their browser context. This enables session hijacking, credential theft, data exfiltration, or the performance of arbitrary actions on behalf of the victim within the MISP application.\n\nVersion affected: \u003c2.5.47"
}
],
"impacts": [
{
"capecId": "CAPEC-63",
"descriptions": [
{
"lang": "en",
"value": "CAPEC-63 Cross-Site Scripting (XSS)"
}
]
}
],
"metrics": [
{
"cvssV4_0": {
"Automatable": "NOT_DEFINED",
"Recovery": "NOT_DEFINED",
"Safety": "NOT_DEFINED",
"attackComplexity": "LOW",
"attackRequirements": "NONE",
"attackVector": "NETWORK",
"baseScore": 6.3,
"baseSeverity": "MEDIUM",
"privilegesRequired": "LOW",
"providerUrgency": "NOT_DEFINED",
"subAvailabilityImpact": "NONE",
"subConfidentialityImpact": "HIGH",
"subIntegrityImpact": "HIGH",
"userInteraction": "PASSIVE",
"valueDensity": "NOT_DEFINED",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:P/VC:L/VI:L/VA:N/SC:H/SI:H/SA:N",
"version": "4.0",
"vulnAvailabilityImpact": "NONE",
"vulnConfidentialityImpact": "LOW",
"vulnIntegrityImpact": "LOW",
"vulnerabilityResponseEffort": "NOT_DEFINED"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-79",
"description": "CWE-79 Improper Neutralization of Input During Web Page Generation (\u0027Cross-site Scripting\u0027)",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-09-21T09:25:04.966Z",
"orgId": "5a6e4751-2f3f-4070-9419-94fb35b644e8",
"shortName": "CIRCL"
},
"references": [
{
"name": "Security patch",
"tags": [
"patch"
],
"url": "https://github.com/MISP/MISP/commit/6b7637bf4"
}
],
"solutions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "\u003cp\u003eThe fix applies CakePHP\u0027s h() HTML-encoding function to the $galaxyName variable before it is passed to sprintf() for HTML output, ensuring that any special characters (angle brackets, quotes, etc.) in the galaxy name are percent-encoded and rendered as inert text rather than executable markup.\u003c/p\u003e"
}
],
"value": "The fix applies CakePHP\u0027s h() HTML-encoding function to the $galaxyName variable before it is passed to sprintf() for HTML output, ensuring that any special characters (angle brackets, quotes, etc.) in the galaxy name are percent-encoded and rendered as inert text rather than executable markup."
}
],
"title": "Stored Cross-Site Scripting in MISP Galaxy Matrix Statistics via Unescaped Galaxy Name",
"x_gcve": [
{
"extensions": {
"bcp-05-x-01": {
"ai_annotations": [
{
"ai_level": "generated",
"description": "Draft vulnerability metadata was generated from a git-format patch using an Ollama-hosted language model. Human validation is required before publication.",
"gna_source": 1,
"models": [
{
"gna_source": 1,
"identifier": "qwen3.8:27b",
"name": "qwen3.8:27b",
"source": "ollama"
}
],
"review_status": "review",
"scope": "record",
"tags": [
"ai-computer-assisted:llm-generated",
"ai-computer-assisted:classification"
]
}
]
},
"bcp-05-x-02": {
"x_patch2vuln": {
"assumptions": [
"perm_galaxy_editor is treated as a low-privilege role (PR:L); if it requires elevated clearance the PR metric should be raised to H.",
"The affected version boundary is inferred from the tag v2.5.47 (47 commits after the fix commit); no explicit \u0027fixed in\u0027 version is stated in the patch.",
"UI:P assumes the victim voluntarily navigates to the statistics page as part of normal workflow rather than being lured by a crafted link (which would be UI:A)."
],
"commit": "6b7637bf46633e880d8fb9900fa69986eabfc82e",
"confidence": "high",
"credits": [
{
"lang": "en",
"type": "reporter",
"value": "Jeroen Pinoy"
},
{
"lang": "en",
"type": "remediation developer",
"value": "iglocska"
},
{
"lang": "en",
"type": "remediation developer",
"value": "Claude Opus 4.8"
}
],
"cvssRationale": "AV:N: The attack is delivered over the network via the MISP web interface. AC:L: Creating a galaxy with a script-bearing name requires no special timing or race condition. AT:N: No additional attack complexity beyond normal application use. PR:L: The attacker needs an authenticated account with perm_galaxy_editor, a low-privilege role. UI:P: The victim must visit the galaxy matrix statistics page, a legitimate page they may open during normal work; no specific tricked action (click, download) is required. VC/VI/VA:N: The MISP server itself suffers no direct confidentiality, integrity, or availability loss; the payload executes client-side. SC:H: The victim\u0027s browser session is fully compromised (cookies, tokens, in-page data). SI:H: The attacker can perform arbitrary actions in the victim\u0027s authenticated session. SA:N: No denial-of-service impact on the victim\u0027s browser. Assumption: perm_galaxy_editor is a low-privilege role (PR:L); if it requires higher clearance, PR could be H.",
"draft": false,
"fixSummary": "The fix applies CakePHP\u0027s h() HTML-encoding function to the $galaxyName variable before it is passed to sprintf() for HTML output, ensuring that any special characters (angle brackets, quotes, etc.) in the galaxy name are percent-encoded and rendered as inert text rather than executable markup.",
"generatedAt": "2026-09-21T08:45:23.903680Z",
"generator": "patch2vuln.py",
"model": "qwen3.8:27b",
"modelComparison": {
"rankings": [
{
"agreementScore": 9,
"assumptionCount": 3,
"confidence": "high",
"model": "qwen3.8:27b",
"score": 8
}
],
"selectedModel": "qwen3.8:27b",
"selectionMethod": "deterministic-consensus-v1",
"selectionNotice": "The selected result is closest to model consensus; this heuristic does not establish factual correctness and human review remains required."
},
"patchSha256": "c87b2f367c3cb449d92ad781865f48beeed01298a6c2a91d9f5234e67ab2930d",
"patchSummary": "In app/View/Users/statistics_galaxymatrix.ctp, the single line echo sprintf(__(\u0027A heatmap showing the usage of %s.\u0027), $galaxyName) was changed to echo sprintf(__(\u0027A heatmap showing the usage of %s.\u0027), h($galaxyName)), wrapping the user-controlled variable with CakePHP\u0027s HTML-encoding helper before interpolation into the HTML document.",
"patchTruncated": false,
"patches": [
{
"commit": "6b7637bf46633e880d8fb9900fa69986eabfc82e",
"patchSha256": "c87b2f367c3cb449d92ad781865f48beeed01298a6c2a91d9f5234e67ab2930d",
"source": "https://github.com/MISP/MISP/commit/6b7637bf4.patch",
"sourceUrl": "https://github.com/MISP/MISP/commit/6b7637bf4.patch",
"subject": "fix: [security] Escape the galaxy name in the statistics"
}
],
"source": "https://github.com/MISP/MISP/commit/6b7637bf4.patch",
"subject": "fix: [security] Escape the galaxy name in the statistics",
"tagVersionBoundary": {
"commits_after_fix": 47,
"repository": "https://github.com/MISP/MISP",
"tag": "v2.5.47",
"version": "2.5.47",
"version_type": "semver"
},
"weaknessRationale": [
{
"cweId": "CWE-79",
"rationale": "The root cause is the direct interpolation of a user-controlled string (galaxy name) into an HTML context without output encoding, allowing script injection. This is a textbook stored XSS (CWE-79)."
}
]
}
}
},
"recordType": "advisory",
"vulnId": "GCVE-1-2026-20155"
}
]
}
},
"cveMetadata": {
"assignerOrgId": "5a6e4751-2f3f-4070-9419-94fb35b644e8",
"assignerShortName": "CIRCL",
"cveId": "CVE-2026-94277",
"datePublished": "2026-09-21T09:25:04.966Z",
"dateReserved": "2026-09-21T09:25:02.306Z",
"dateUpdated": "2026-09-21T11:16:10.434Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
}
}
Loading…
Loading…
Experimental. This forecast is provided for visualization only and may change without notice. Do not use it for operational decisions.
Forecast uses a logistic model when the trend is rising, or an exponential decay model when the trend is falling. Fitted via linearized least squares.
Sightings
| Author | Source | Type | Date | Other |
|---|
Nomenclature
- Seen: The vulnerability was mentioned, discussed, or observed by the user.
- Confirmed: The vulnerability has been validated from an analyst's perspective.
- Published Proof of Concept: A public proof of concept is available for this vulnerability.
- Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
- Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
- Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
- Not confirmed: The user expressed doubt about the validity of the vulnerability.
- Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.
Loading…
The MITRE ATT&CK techniques below are AI-generated suggestions, inferred from the description of the
vulnerability by the CIRCL/vulnerability-attack-technique-classification-roberta-base
model, served locally by ML-Gateway.
They have not been verified by an analyst and are provided for guidance only.
The approach is described in our paper Mapping CVEs to MITRE ATT&CK Techniques: A Curated Gold-Set Classifier and the Limits of LLM-Assisted Label Expansion.
Browse all ATT&CK techniques and the vulnerabilities related to each.
The approach is described in our paper Mapping CVEs to MITRE ATT&CK Techniques: A Curated Gold-Set Classifier and the Limits of LLM-Assisted Label Expansion.
Browse all ATT&CK techniques and the vulnerabilities related to each.
Loading…
Related by attack behaviour
Vulnerabilities whose description is nearest to this one in the vector space of the CIRCL/vulnerability-attack-technique-biencoder model. This is a similarity search over the bi-encoder space (plain cosine), not a classification, and it has no measured accuracy.
Loading…