GCVE-1-2026-20332 (CVE-2026-112184)

Vulnerability from gna-1 – Published: 2026-10-19 09:19 – Updated: 2026-10-19 09:19
VLAI
Title
MISP Workflow Module: Reflected XSS via Unescaped misp-modules Parameter Names in Form Labels
Summary
MISP contains a reflected cross-site scripting (XSS) vulnerability in the workflow module interface. Parameter names returned by the misp-modules service are rendered as raw HTML form labels on the workflow module page without output encoding. An attacker who can influence the parameter names reported by the misp-modules service can inject arbitrary HTML or JavaScript that executes in the context of an authenticated MISP user's browser. Preconditions: - The attacker must be able to control or influence parameter names reported by the misp-modules service. - A victim must be authenticated and view the affected workflow module page. Impact: - Execution of arbitrary JavaScript in the victim's browser session. - Potential theft of session tokens, manipulation of the MISP interface, or initiation of unauthorized actions on behalf of the victim. Affected versions: <2.5.48.
Severity
4.8 (Medium)
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:A/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N
SSVC
Exploitation: none Automatable: yes Technical Impact: partial
Supplier · CNA (v2.0.3)
Decision recorded 2026-10-19 09:16 UTC
CWE
  • CWE-79 - Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
Assigner
CIRCL GNA GNA-1
GNA scorecard A 90/100 over 252 records in the last 180 days details
References
Impacted products
Vendor Product Version CPE status
MISP MISP Affected: 0 , < 2.5.48 (semver)
    cpe:2.3:a:misp:misp:*:*:*:*:*:*:*:*
Create a notification for this product.
Credits
Jeroen Pinoy iglocska Claude Opus 5.5 (1M context)
GCVE extensions
bcp-05-x-01
AI-assisted vulnerability information annotation
GCVE-BCP-05-X-01
Whole record AI-generated Human-reviewed GNA-1

Draft vulnerability metadata was generated from a git-format patch using an Ollama-hosted language model. Human validation is required before publication.

ai-computer-assisted:llm-generatedai-computer-assisted:classification
Model Source Identifier
qwen3.8:27b ollama qwen3.8:27b
bcp-05-x-02
Patch-to-vulnerability generation provenance
GCVE-BCP-05-X-02
Generator
patch2vuln.py on 2026-10-19 09:16
Model
qwen3.8:27b
Input
https://github.com/MISP/MISP/commit/813a48b2b.patch 691d31d09a8d…
Confidence
medium
Commit Subject Patch SHA-256
813a48b2bac0 fix: [workflows] Escape misp-module parameter names used as 691d31d09a8d…
Fix summary

The fix applies HTML output encoding (the h() helper) to the parameter name before it is used as a form label, ensuring that any HTML metacharacters in the value are neutralized and rendered as inert text rather than executable markup.

Patch summary

In app/Model/WorkflowModules/Module_misp_module.php, the translateParams method was modified: the 'label' array element changed from Inflector::humanize($paramName) to h(Inflector::humanize($paramName)), wrapping the humanized parameter name in CakePHP's HTML-encoding function before it is assigned as a form label.

CVSS rationale

AV:N – web-based, reachable over the network. AC:L – no race or special timing; the misp-modules service simply needs to return a crafted parameter name. AT:N – no manipulation of the target system required. PR:L – the victim must be an authenticated MISP user to view the workflow module page. UI:A – the victim must actively load the workflow module page for the script to execute. VC/VI/VA:N – the MISP server itself is not compromised. SC:L – the attacker can read cookies or session data in the victim's browser. SI:L – the attacker can modify the page or perform actions in the victim's session. SA:N – no elevation of security authority on the server.

Weakness rationale
  • CWE-79 The parameter name from an external service is inserted into HTML output (a form label) without HTML encoding, allowing injected markup or script to execute in the victim's browser. This is a textbook reflected XSS.
Attack pattern rationale
  • CAPEC-1 The misp-modules service supplies parameter names that are reflected into the HTML of the workflow module page without encoding. The attacker-controlled data flows from an external source into the rendered output, matching the reflected XSS pattern. Uncertainty: the data originates from a backend service rather than a direct HTTP parameter, but the effect (untrusted data reflected into HTML without encoding) is functionally identical to reflected XSS.
Assumptions to verify
  • The misp-modules service is assumed to be a component whose output can be influenced by a module developer or a compromised service endpoint; the exact attack vector for injecting a malicious parameter name is not detailed in the patch.
  • MISP requires authentication to access the workflow module page; PR:L is assumed based on MISP's standard access model.
  • The affected version boundary (< 2.5.48) is inferred from the tag_version_boundary metadata (v2.5.48, 25 commits after fix); the exact first affected version is not specified.
  • CAPEC-1 (Reflected XSS) is the closest match; the data source is a backend service rather than a direct request parameter, but the unencoded reflection into HTML is the defining characteristic.
  • The h() function is assumed to be CakePHP's HTML-encoding helper (equivalent to htmlspecialchars), based on the framework context of the MISP codebase.
Model comparison

Selected qwen3.8:27b by deterministic-consensus-v1
The selected result is closest to model consensus; this heuristic does not establish factual correctness and human review remains required.

Model Score Agreement Confidence Assumptions
qwen3.8:27b 7 11 medium 5
bcp-05-x-03
Vulnerability handling and disclosure timeline
GCVE-BCP-05-X-03
  1. 2026-09-24 22:12 UTC Fix developed Corrective change authored (813a48b2bac0c9034f532b9181ac9a0c5fa59857): fix: [workflows] Escape misp-module parameter names used as
To clipboard 

{
  "containers": {
    "cna": {
      "affected": [
        {
          "cpes": [
            "cpe:2.3:a:misp:misp:*:*:*:*:*:*:*:*"
          ],
          "modules": [
            "Workflow Modules (Module_misp_module)"
          ],
          "product": "MISP",
          "programFiles": [
            "app/Model/WorkflowModules/Module_misp_module.php"
          ],
          "repo": "https://github.com/MISP/MISP",
          "vendor": "MISP",
          "versions": [
            {
              "lessThan": "2.5.48",
              "status": "affected",
              "version": "0",
              "versionType": "semver"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "reporter",
          "value": "Jeroen Pinoy"
        },
        {
          "lang": "en",
          "type": "remediation developer",
          "value": "iglocska"
        },
        {
          "lang": "en",
          "type": "remediation developer",
          "value": "Claude Opus 5.5 (1M context)"
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "supportingMedia": [
            {
              "base64": false,
              "type": "text/html",
              "value": "\u003cp\u003eMISP contains a reflected cross-site scripting (XSS) vulnerability in the workflow module interface. Parameter names returned by the misp-modules service are rendered as raw HTML form labels on the workflow module page without output encoding. An attacker who can influence the parameter names reported by the misp-modules service can inject arbitrary HTML or JavaScript that executes in the context of an authenticated MISP user\u0027s browser.\u003c/p\u003e\u003cp\u003ePreconditions:\u003c/p\u003e\u003cp\u003e- The attacker must be able to control or influence parameter names reported by the misp-modules service.\u003c/p\u003e\u003cp\u003e- A victim must be authenticated and view the affected workflow module page.\u003c/p\u003e\u003cp\u003eImpact:\u003c/p\u003e\u003cp\u003e- Execution of arbitrary JavaScript in the victim\u0027s browser session.\u003c/p\u003e\u003cp\u003e- Potential theft of session tokens, manipulation of the MISP interface, or initiation of unauthorized actions on behalf of the victim.\u003c/p\u003e\u003cp\u003eAffected versions: \u0026lt;2.5.48.\u003c/p\u003e"
            }
          ],
          "value": "MISP contains a reflected cross-site scripting (XSS) vulnerability in the workflow module interface. Parameter names returned by the misp-modules service are rendered as raw HTML form labels on the workflow module page without output encoding. An attacker who can influence the parameter names reported by the misp-modules service can inject arbitrary HTML or JavaScript that executes in the context of an authenticated MISP user\u0027s browser.\n\nPreconditions:\n\n- The attacker must be able to control or influence parameter names reported by the misp-modules service.\n\n- A victim must be authenticated and view the affected workflow module page.\n\nImpact:\n\n- Execution of arbitrary JavaScript in the victim\u0027s browser session.\n\n- Potential theft of session tokens, manipulation of the MISP interface, or initiation of unauthorized actions on behalf of the victim.\n\nAffected versions: \u003c2.5.48."
        }
      ],
      "impacts": [
        {
          "capecId": "CAPEC-1",
          "descriptions": [
            {
              "lang": "en",
              "value": "CAPEC-1 XSS - Reflected"
            }
          ]
        }
      ],
      "metrics": [
        {
          "cvssV4_0": {
            "Automatable": "NOT_DEFINED",
            "Recovery": "NOT_DEFINED",
            "Safety": "NOT_DEFINED",
            "attackComplexity": "LOW",
            "attackRequirements": "NONE",
            "attackVector": "NETWORK",
            "baseScore": 4.8,
            "baseSeverity": "MEDIUM",
            "privilegesRequired": "LOW",
            "providerUrgency": "NOT_DEFINED",
            "subAvailabilityImpact": "NONE",
            "subConfidentialityImpact": "LOW",
            "subIntegrityImpact": "LOW",
            "userInteraction": "ACTIVE",
            "valueDensity": "NOT_DEFINED",
            "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:A/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N",
            "version": "4.0",
            "vulnAvailabilityImpact": "NONE",
            "vulnConfidentialityImpact": "NONE",
            "vulnIntegrityImpact": "NONE",
            "vulnerabilityResponseEffort": "NOT_DEFINED"
          },
          "format": "CVSS",
          "scenarios": [
            {
              "lang": "en",
              "value": "GENERAL"
            }
          ]
        },
        {
          "format": "SSVC",
          "other": {
            "content": {
              "options": [
                {
                  "Exploitation": "none"
                },
                {
                  "Automatable": "yes"
                },
                {
                  "Technical Impact": "partial"
                }
              ],
              "role": "Supplier",
              "timestamp": "2026-10-19T09:16:56Z",
              "version": "2.0.3"
            },
            "type": "SSVC"
          },
          "scenarios": [
            {
              "lang": "en",
              "value": "GENERAL"
            }
          ]
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-79",
              "description": "CWE-79 Improper Neutralization of Input During Web Page Generation (\u0027Cross-site Scripting\u0027)",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "orgId": "00000000-0000-4000-9000-000000000000"
      },
      "references": [
        {
          "name": "Security patch",
          "tags": [
            "patch"
          ],
          "url": "https://github.com/MISP/MISP/commit/813a48b2b"
        }
      ],
      "solutions": [
        {
          "lang": "en",
          "supportingMedia": [
            {
              "base64": false,
              "type": "text/html",
              "value": "\u003cp\u003eThe fix applies HTML output encoding (the h() helper) to the parameter name before it is used as a form label, ensuring that any HTML metacharacters in the value are neutralized and rendered as inert text rather than executable markup.\u003c/p\u003e"
            }
          ],
          "value": "The fix applies HTML output encoding (the h() helper) to the parameter name before it is used as a form label, ensuring that any HTML metacharacters in the value are neutralized and rendered as inert text rather than executable markup."
        }
      ],
      "title": "MISP Workflow Module: Reflected XSS via Unescaped misp-modules Parameter Names in Form Labels",
      "x_gcve": [
        {
          "extensions": {
            "bcp-05-x-01": {
              "ai_annotations": [
                {
                  "ai_level": "generated",
                  "description": "Draft vulnerability metadata was generated from a git-format patch using an Ollama-hosted language model. Human validation is required before publication.",
                  "gna_source": 1,
                  "models": [
                    {
                      "gna_source": 1,
                      "identifier": "qwen3.8:27b",
                      "name": "qwen3.8:27b",
                      "source": "ollama"
                    }
                  ],
                  "review_status": "full",
                  "scope": "record",
                  "tags": [
                    "ai-computer-assisted:llm-generated",
                    "ai-computer-assisted:classification"
                  ]
                }
              ]
            },
            "bcp-05-x-02": {
              "x_patch2vuln": {
                "assumptions": [
                  "The misp-modules service is assumed to be a component whose output can be influenced by a module developer or a compromised service endpoint; the exact attack vector for injecting a malicious parameter name is not detailed in the patch.",
                  "MISP requires authentication to access the workflow module page; PR:L is assumed based on MISP\u0027s standard access model.",
                  "The affected version boundary (\u003c 2.5.48) is inferred from the tag_version_boundary metadata (v2.5.48, 25 commits after fix); the exact first affected version is not specified.",
                  "CAPEC-1 (Reflected XSS) is the closest match; the data source is a backend service rather than a direct request parameter, but the unencoded reflection into HTML is the defining characteristic.",
                  "The h() function is assumed to be CakePHP\u0027s HTML-encoding helper (equivalent to htmlspecialchars), based on the framework context of the MISP codebase."
                ],
                "capecRationale": [
                  {
                    "capecId": "CAPEC-1",
                    "rationale": "The misp-modules service supplies parameter names that are reflected into the HTML of the workflow module page without encoding. The attacker-controlled data flows from an external source into the rendered output, matching the reflected XSS pattern. Uncertainty: the data originates from a backend service rather than a direct HTTP parameter, but the effect (untrusted data reflected into HTML without encoding) is functionally identical to reflected XSS."
                  }
                ],
                "commit": "813a48b2bac0c9034f532b9181ac9a0c5fa59857",
                "confidence": "medium",
                "credits": [
                  {
                    "lang": "en",
                    "type": "reporter",
                    "value": "Jeroen Pinoy"
                  },
                  {
                    "lang": "en",
                    "type": "remediation developer",
                    "value": "iglocska"
                  },
                  {
                    "lang": "en",
                    "type": "remediation developer",
                    "value": "Claude Opus 5.5 (1M context)"
                  }
                ],
                "cvssRationale": "AV:N \u2013 web-based, reachable over the network. AC:L \u2013 no race or special timing; the misp-modules service simply needs to return a crafted parameter name. AT:N \u2013 no manipulation of the target system required. PR:L \u2013 the victim must be an authenticated MISP user to view the workflow module page. UI:A \u2013 the victim must actively load the workflow module page for the script to execute. VC/VI/VA:N \u2013 the MISP server itself is not compromised. SC:L \u2013 the attacker can read cookies or session data in the victim\u0027s browser. SI:L \u2013 the attacker can modify the page or perform actions in the victim\u0027s session. SA:N \u2013 no elevation of security authority on the server.",
                "fixSummary": "The fix applies HTML output encoding (the h() helper) to the parameter name before it is used as a form label, ensuring that any HTML metacharacters in the value are neutralized and rendered as inert text rather than executable markup.",
                "generatedAt": "2026-10-19T09:16:56.467726Z",
                "generator": "patch2vuln.py",
                "model": "qwen3.8:27b",
                "modelComparison": {
                  "rankings": [
                    {
                      "agreementScore": 11,
                      "assumptionCount": 5,
                      "confidence": "medium",
                      "model": "qwen3.8:27b",
                      "score": 7
                    }
                  ],
                  "selectedModel": "qwen3.8:27b",
                  "selectionMethod": "deterministic-consensus-v1",
                  "selectionNotice": "The selected result is closest to model consensus; this heuristic does not establish factual correctness and human review remains required."
                },
                "patchSha256": "691d31d09a8db397d602b6d179507339a60ca0125e91b55d408353abf8473bac",
                "patchSummary": "In app/Model/WorkflowModules/Module_misp_module.php, the translateParams method was modified: the \u0027label\u0027 array element changed from Inflector::humanize($paramName) to h(Inflector::humanize($paramName)), wrapping the humanized parameter name in CakePHP\u0027s HTML-encoding function before it is assigned as a form label.",
                "patchTruncated": false,
                "patches": [
                  {
                    "commit": "813a48b2bac0c9034f532b9181ac9a0c5fa59857",
                    "date": "Fri, 25 Sep 2026 00:12:54 +0200",
                    "patchSha256": "691d31d09a8db397d602b6d179507339a60ca0125e91b55d408353abf8473bac",
                    "source": "https://github.com/MISP/MISP/commit/813a48b2b.patch",
                    "sourceUrl": "https://github.com/MISP/MISP/commit/813a48b2b.patch",
                    "subject": "fix: [workflows] Escape misp-module parameter names used as"
                  }
                ],
                "source": "https://github.com/MISP/MISP/commit/813a48b2b.patch",
                "ssvc": {
                  "options": [
                    {
                      "Exploitation": "none"
                    },
                    {
                      "Automatable": "yes"
                    },
                    {
                      "Technical Impact": "partial"
                    }
                  ],
                  "role": "Supplier",
                  "timestamp": "2026-10-19T09:16:56Z",
                  "version": "2.0.3"
                },
                "subject": "fix: [workflows] Escape misp-module parameter names used as",
                "tagVersionBoundary": {
                  "commits_after_fix": 25,
                  "repository": "https://github.com/MISP/MISP",
                  "tag": "v2.5.48",
                  "version": "2.5.48",
                  "version_type": "semver"
                },
                "weaknessRationale": [
                  {
                    "cweId": "CWE-79",
                    "rationale": "The parameter name from an external service is inserted into HTML output (a form label) without HTML encoding, allowing injected markup or script to execute in the victim\u0027s browser. This is a textbook reflected XSS."
                  }
                ]
              }
            },
            "bcp-05-x-03": {
              "x_timeline": {
                "events": [
                  {
                    "description": "Corrective change authored (813a48b2bac0c9034f532b9181ac9a0c5fa59857): fix: [workflows] Escape misp-module parameter names used as",
                    "id": "evt-fix-developed-1",
                    "references": [
                      "https://github.com/MISP/MISP/commit/813a48b2b.patch"
                    ],
                    "timestamp": "2026-09-24T22:12:54Z",
                    "type": "fix-developed"
                  }
                ]
              }
            }
          },
          "recordType": "advisory",
          "vulnId": "GCVE-1-2026-20332"
        }
      ]
    }
  },
  "cveMetadata": {
    "assignerOrgId": "00000000-0000-4000-9000-000000000000",
    "cveId": "CVE-2026-112184",
    "datePublished": "2026-10-19T09:19:33.217828Z",
    "dateReserved": "2026-10-19T09:19:41.258Z",
    "dateUpdated": "2026-10-19T09:19:42.654377Z",
    "state": "PUBLISHED",
    "vulnId": "GCVE-1-2026-20332"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1"
}



Log in or create an account to share your comment.




Tags
Taxonomy of the tags.




Drag nodes to arrange them. Double-click a related vulnerability to open it, or a source to visit its link. The Physics button on the left tunes the layout and the simulation; the legend at the bottom left hides or shows nodes by kind and by sighting type.

Forecast uses a logistic model when the trend is rising, or an exponential decay model when the trend is falling. Fitted via linearized least squares.

Sightings

Author Source Type Date Other

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or observed by the user.
  • Confirmed: The vulnerability has been validated from an analyst's perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
  • Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
  • Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
  • Not confirmed: The user expressed doubt about the validity of the vulnerability.
  • Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.
Vulnerability timeline

Sightings and recorded dates, grouped by day · UTC

JSON

Loading timeline…




    Related by attack behaviour

    Vulnerabilities whose description is nearest to this one in the vector space of the CIRCL/vulnerability-attack-technique-biencoder model. This is a similarity search over the bi-encoder space (plain cosine), not a classification, and it has no measured accuracy.