Vulnerability-Lookup

GHSA-CCJM-JPCQ-P5HF

Vulnerability from github – Published: 2026-09-30 15:31 – Updated: 2026-09-30 15:31

Details

When another user views the affected Galaxy Cluster and clicks the rendered link, the embedded script executes in the victim's browser context, enabling session hijacking, data exfiltration, or actions performed on behalf of the victim.

Preconditions:

Attacker must hold galaxy editor privileges (local or via sync).
Victim must view the affected cluster and click the malicious link.

Impact:

Stored cross-site scripting (XSS) in the victim's browser.
Potential session theft, credential harvesting, or unauthorized actions within the MISP application.

Affected: <2.5.48.

Severity

6.2 (Medium)


                  
                    CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:A/VC:N/VI:N/VA:N/SC:H/SI:H/SA:N

Show details on source website

JSON

To clipboard

{
  "affected": [],
  "aliases": [
    "CVE-2026-103388"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-79"
    ],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2026-09-30T15:22:27Z",
    "severity": "MODERATE"
  },
  "details": "MISP renders the source field of a Galaxy Cluster as a clickable hyperlink whenever the stored value passes PHP\u0027s FILTER_VALIDATE_URL validation. Because FILTER_VALIDATE_URL accepts the javascript: URI scheme, a user with galaxy editor privileges on the local instance or on a synced instance could store a javascript: URL as the cluster source.\n\nWhen another user views the affected Galaxy Cluster and clicks the rendered link, the embedded script executes in the victim\u0027s browser context, enabling session hijacking, data exfiltration, or actions performed on behalf of the victim.\n\nPreconditions:\n\n- Attacker must hold galaxy editor privileges (local or via sync).\n\n- Victim must view the affected cluster and click the malicious link.\n\nImpact:\n\n- Stored cross-site scripting (XSS) in the victim\u0027s browser.\n\n- Potential session theft, credential harvesting, or unauthorized actions within the MISP application.\n\nAffected: \u003c2.5.48.",
  "id": "GHSA-ccjm-jpcq-p5hf",
  "modified": "2026-09-30T15:31:34Z",
  "published": "2026-09-30T15:31:34Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-103388"
    },
    {
      "type": "WEB",
      "url": "https://github.com/MISP/MISP/commit/118528767"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:A/VC:N/VI:N/VA:N/SC:H/SI:H/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X",
      "type": "CVSS_V4"
    }
  ]
}

CVE-2026-103388 (GCVE-0-2026-103388)

Vulnerability from cvelistv5 – Published: 2026-09-30 14:22 – Updated: 2026-09-30 15:28

Title

MISP Stored Cross-Site Scripting via JavaScript URL in Galaxy Cluster Source Field

Summary

MISP renders the source field of a Galaxy Cluster as a clickable hyperlink whenever the stored value passes PHP's FILTER_VALIDATE_URL validation. Because FILTER_VALIDATE_URL accepts the javascript: URI scheme, a user with galaxy editor privileges on the local instance or on a synced instance could store a javascript: URL as the cluster source. When another user views the affected Galaxy Cluster and clicks the rendered link, the embedded script executes in the victim's browser context, enabling session hijacking, data exfiltration, or actions performed on behalf of the victim. Preconditions: - Attacker must hold galaxy editor privileges (local or via sync). - Victim must view the affected cluster and click the malicious link. Impact: - Stored cross-site scripting (XSS) in the victim's browser. - Potential session theft, credential harvesting, or unauthorized actions within the MISP application. Affected: <2.5.48.

Severity

6.2 (Medium)


                        
                          CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:A/VC:N/VI:N/VA:N/SC:H/SI:H/SA:N

SSVC

Exploitation: none Automatable: no Technical Impact: partial

CISA Coordinator · CISA-ADP (v2.0.3)

Decision recorded 2026-09-30 14:58 UTC

CWE

CWE-79 - Improper Neutralization of Input in Web Page ('Cross-site Scripting')

Assigner

CIRCL ENISA root Scorecard

References

1 reference

URL	Tags
https://github.com/MISP/MISP/commit/118528767	patch

Impacted products

1 product

Vendor	Product	Version
MISP	MISP	Affected: 0 , < 2.5.48 (semver) cpe:2.3:a:misp:misp::::::::

Credits

Jeroen Pinoy iglocska Claude Opus 5.5 (1M context)

GCVE extensions

AI-generated Human-reviewed Confidence: high Model qwen3.8:27b advisory bcp-05-x-01bcp-05-x-02

AI involvement GCVE-BCP-05-X-01

Whole record AI-generated Human-reviewed GNA-1

Draft vulnerability metadata was generated from a git-format patch using an Ollama-hosted language model. Human validation is required before publication.

ai-computer-assisted:llm-generatedai-computer-assisted:classification

Model	Source	Identifier
qwen3.8:27b	ollama	`qwen3.8:27b`

Patch provenance GCVE-BCP-05-X-02

Generator: patch2vuln.py on 2026-09-30 14:12
Model: qwen3.8:27b
Input: https://github.com/MISP/MISP/commit/118528767.patch b68dbd672692…
Confidence: high

Commit	Subject	Patch SHA-256
`118528767735`	fix: [security] Link a galaxy cluster source only when it is	`b68dbd672692…`

Fix summary

The fix restricts the rendering of the Galaxy Cluster source field as a hyperlink to only http:// and https:// URLs by adding a regular-expression check (preg_match for ^https?://) in addition to the existing FILTER_VALIDATE_URL validation. This prevents javascript: and other non-HTTP URI schemes from being rendered as clickable links, eliminating the stored XSS vector. The change is applied consistently in both the default theme and the Overmind theme.

Patch summary

Two view templates are modified. In app/View/GalaxyClusters/view.ctp, the source value is extracted into a local variable and the conditional for rendering an anchor tag now requires both FILTER_VALIDATE_URL and a preg_match against /^https?:\/\//i. In app/View/Themed/Overmind/Elements/GalaxyClusters/View/galaxy_clusters_general.ctp, the same preg_match guard is added to the existing FILTER_VALIDATE_URL check. Net effect: only http(s) URLs produce a clickable link; all other values (including javascript:) are rendered as plain escaped text.

CVSS rationale

AV:N – MISP is a web application accessed over the network. AC:L – no race conditions or special environment needed; storing a javascript: URL is straightforward. AT:N – no manipulation of the attack target required. PR:L – attacker needs galaxy editor privileges (authenticated, non-admin role). UI:A – victim must click the malicious link for script execution. VC/VI/VA:N – the MISP server itself is not directly compromised; impact is on the victim's browser. SC:H – attacker can read cookies, session tokens, and manipulate the DOM in the victim's session. SI:H – attacker can perform actions on behalf of the victim within MISP. SA:N – no direct compromise of the application's security controls or system integrity.

Weakness rationale

CWE-79 The application renders user-controlled data (the galaxy cluster source field) into an HTML anchor tag without restricting the URI scheme to safe values. Although output is HTML-escaped via h(), the href attribute still accepts javascript: URIs, resulting in stored XSS. CWE-79 is the narrowest defensible mapping.

Attack pattern rationale

CAPEC-64 The attack pattern involves storing a malicious payload (a javascript: URL) in a persistent data field (galaxy cluster source) that is later rendered in a web page, executing script in the victim's browser upon interaction. This is a textbook persistent/stored XSS. CAPEC-64 is the closest and most precise match in the CAPEC catalog.

Assumptions to verify

The affected version boundary is inferred from the tag_version_boundary metadata (v2.5.48, 26 commits after fix); the exact first affected release is not stated in the patch.
PR:L assumes galaxy editor privileges are a non-admin, role-based permission; the exact privilege model is not detailed in the patch.
UI:A assumes the victim must actively click the rendered link; passive rendering without click does not execute the script.
The CAPEC-64 mapping is the closest available pattern for stored XSS; no CAPEC specifically covers URI-scheme-based stored XSS, so CAPEC-64 is the best fit.
The Co-Authored-By line references an AI assistant; it is credited as a tool rather than a human remediation developer.

Model comparison

Selected qwen3.8:27b by deterministic-consensus-v1
The selected result is closest to model consensus; this heuristic does not establish factual correctness and human review remains required.

Model	Score	Agreement	Confidence	Assumptions
`qwen3.8:27b`	6	9	high	5

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-103388",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-09-30T14:58:39.451751Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-09-30T15:28:06.980Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "cpes": [
            "cpe:2.3:a:misp:misp:*:*:*:*:*:*:*:*"
          ],
          "modules": [
            "GalaxyClusters view (default theme)",
            "GalaxyClusters view (Overmind theme)"
          ],
          "product": "MISP",
          "programFiles": [
            "app/View/GalaxyClusters/view.ctp",
            "app/View/Themed/Overmind/Elements/GalaxyClusters/View/galaxy_clusters_general.ctp"
          ],
          "repo": "https://github.com/MISP/MISP",
          "vendor": "MISP",
          "versions": [
            {
              "lessThan": "2.5.48",
              "status": "affected",
              "version": "0",
              "versionType": "semver"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "reporter",
          "value": "Jeroen Pinoy"
        },
        {
          "lang": "en",
          "type": "remediation developer",
          "value": "iglocska"
        },
        {
          "lang": "en",
          "type": "remediation developer",
          "value": "Claude Opus 5.5 (1M context)"
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "supportingMedia": [
            {
              "base64": false,
              "type": "text/html",
              "value": "\u003cp\u003eMISP renders the source field of a Galaxy Cluster as a clickable hyperlink whenever the stored value passes PHP\u0027s FILTER_VALIDATE_URL validation. Because FILTER_VALIDATE_URL accepts the javascript: URI scheme, a user with galaxy editor privileges on the local instance or on a synced instance could store a javascript: URL as the cluster source.\u003c/p\u003e\u003cp\u003eWhen another user views the affected Galaxy Cluster and clicks the rendered link, the embedded script executes in the victim\u0027s browser context, enabling session hijacking, data exfiltration, or actions performed on behalf of the victim.\u003c/p\u003e\u003cp\u003ePreconditions:\u003c/p\u003e\u003cp\u003e- Attacker must hold galaxy editor privileges (local or via sync).\u003c/p\u003e\u003cp\u003e- Victim must view the affected cluster and click the malicious link.\u003c/p\u003e\u003cp\u003eImpact:\u003c/p\u003e\u003cp\u003e- Stored cross-site scripting (XSS) in the victim\u0027s browser.\u003c/p\u003e\u003cp\u003e- Potential session theft, credential harvesting, or unauthorized actions within the MISP application.\u003c/p\u003e\u003cp\u003eAffected: \u0026lt;2.5.48.\u003c/p\u003e"
            }
          ],
          "value": "MISP renders the source field of a Galaxy Cluster as a clickable hyperlink whenever the stored value passes PHP\u0027s FILTER_VALIDATE_URL validation. Because FILTER_VALIDATE_URL accepts the javascript: URI scheme, a user with galaxy editor privileges on the local instance or on a synced instance could store a javascript: URL as the cluster source.\n\nWhen another user views the affected Galaxy Cluster and clicks the rendered link, the embedded script executes in the victim\u0027s browser context, enabling session hijacking, data exfiltration, or actions performed on behalf of the victim.\n\nPreconditions:\n\n- Attacker must hold galaxy editor privileges (local or via sync).\n\n- Victim must view the affected cluster and click the malicious link.\n\nImpact:\n\n- Stored cross-site scripting (XSS) in the victim\u0027s browser.\n\n- Potential session theft, credential harvesting, or unauthorized actions within the MISP application.\n\nAffected: \u003c2.5.48."
        }
      ],
      "impacts": [
        {
          "capecId": "CAPEC-64",
          "descriptions": [
            {
              "lang": "en",
              "value": "CAPEC-64 XSS - Persistent"
            }
          ]
        }
      ],
      "metrics": [
        {
          "cvssV4_0": {
            "Automatable": "NOT_DEFINED",
            "Recovery": "NOT_DEFINED",
            "Safety": "NOT_DEFINED",
            "attackComplexity": "LOW",
            "attackRequirements": "NONE",
            "attackVector": "NETWORK",
            "baseScore": 6.2,
            "baseSeverity": "MEDIUM",
            "privilegesRequired": "LOW",
            "providerUrgency": "NOT_DEFINED",
            "subAvailabilityImpact": "NONE",
            "subConfidentialityImpact": "HIGH",
            "subIntegrityImpact": "HIGH",
            "userInteraction": "ACTIVE",
            "valueDensity": "NOT_DEFINED",
            "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:A/VC:N/VI:N/VA:N/SC:H/SI:H/SA:N",
            "version": "4.0",
            "vulnAvailabilityImpact": "NONE",
            "vulnConfidentialityImpact": "NONE",
            "vulnIntegrityImpact": "NONE",
            "vulnerabilityResponseEffort": "NOT_DEFINED"
          },
          "format": "CVSS",
          "scenarios": [
            {
              "lang": "en",
              "value": "GENERAL"
            }
          ]
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-79",
              "description": "CWE-79 Improper Neutralization of Input in Web Page (\u0027Cross-site Scripting\u0027)",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-09-30T14:22:36.271Z",
        "orgId": "5a6e4751-2f3f-4070-9419-94fb35b644e8",
        "shortName": "CIRCL"
      },
      "references": [
        {
          "name": "Security patch",
          "tags": [
            "patch"
          ],
          "url": "https://github.com/MISP/MISP/commit/118528767"
        }
      ],
      "solutions": [
        {
          "lang": "en",
          "supportingMedia": [
            {
              "base64": false,
              "type": "text/html",
              "value": "\u003cp\u003eThe fix restricts the rendering of the Galaxy Cluster source field as a hyperlink to only http:// and https:// URLs by adding a regular-expression check (preg_match for ^https?://) in addition to the existing FILTER_VALIDATE_URL validation. This prevents javascript: and other non-HTTP URI schemes from being rendered as clickable links, eliminating the stored XSS vector. The change is applied consistently in both the default theme and the Overmind theme.\u003c/p\u003e"
            }
          ],
          "value": "The fix restricts the rendering of the Galaxy Cluster source field as a hyperlink to only http:// and https:// URLs by adding a regular-expression check (preg_match for ^https?://) in addition to the existing FILTER_VALIDATE_URL validation. This prevents javascript: and other non-HTTP URI schemes from being rendered as clickable links, eliminating the stored XSS vector. The change is applied consistently in both the default theme and the Overmind theme."
        }
      ],
      "title": "MISP Stored Cross-Site Scripting via JavaScript URL in Galaxy Cluster Source Field",
      "x_gcve": [
        {
          "extensions": {
            "bcp-05-x-01": {
              "ai_annotations": [
                {
                  "ai_level": "generated",
                  "description": "Draft vulnerability metadata was generated from a git-format patch using an Ollama-hosted language model. Human validation is required before publication.",
                  "gna_source": 1,
                  "models": [
                    {
                      "gna_source": 1,
                      "identifier": "qwen3.8:27b",
                      "name": "qwen3.8:27b",
                      "source": "ollama"
                    }
                  ],
                  "review_status": "full",
                  "scope": "record",
                  "tags": [
                    "ai-computer-assisted:llm-generated",
                    "ai-computer-assisted:classification"
                  ]
                }
              ]
            },
            "bcp-05-x-02": {
              "x_patch2vuln": {
                "assumptions": [
                  "The affected version boundary is inferred from the tag_version_boundary metadata (v2.5.48, 26 commits after fix); the exact first affected release is not stated in the patch.",
                  "PR:L assumes galaxy editor privileges are a non-admin, role-based permission; the exact privilege model is not detailed in the patch.",
                  "UI:A assumes the victim must actively click the rendered link; passive rendering without click does not execute the script.",
                  "The CAPEC-64 mapping is the closest available pattern for stored XSS; no CAPEC specifically covers URI-scheme-based stored XSS, so CAPEC-64 is the best fit.",
                  "The Co-Authored-By line references an AI assistant; it is credited as a tool rather than a human remediation developer."
                ],
                "capecRationale": [
                  {
                    "capecId": "CAPEC-64",
                    "rationale": "The attack pattern involves storing a malicious payload (a javascript: URL) in a persistent data field (galaxy cluster source) that is later rendered in a web page, executing script in the victim\u0027s browser upon interaction. This is a textbook persistent/stored XSS. CAPEC-64 is the closest and most precise match in the CAPEC catalog."
                  }
                ],
                "commit": "11852876773554d79ff57937a235d18a1e4473dc",
                "confidence": "high",
                "credits": [
                  {
                    "lang": "en",
                    "type": "reporter",
                    "value": "Jeroen Pinoy"
                  },
                  {
                    "lang": "en",
                    "type": "remediation developer",
                    "value": "iglocska"
                  },
                  {
                    "lang": "en",
                    "type": "remediation developer",
                    "value": "Claude Opus 5.5 (1M context)"
                  }
                ],
                "cvssRationale": "AV:N \u2013 MISP is a web application accessed over the network. AC:L \u2013 no race conditions or special environment needed; storing a javascript: URL is straightforward. AT:N \u2013 no manipulation of the attack target required. PR:L \u2013 attacker needs galaxy editor privileges (authenticated, non-admin role). UI:A \u2013 victim must click the malicious link for script execution. VC/VI/VA:N \u2013 the MISP server itself is not directly compromised; impact is on the victim\u0027s browser. SC:H \u2013 attacker can read cookies, session tokens, and manipulate the DOM in the victim\u0027s session. SI:H \u2013 attacker can perform actions on behalf of the victim within MISP. SA:N \u2013 no direct compromise of the application\u0027s security controls or system integrity.",
                "fixSummary": "The fix restricts the rendering of the Galaxy Cluster source field as a hyperlink to only http:// and https:// URLs by adding a regular-expression check (preg_match for ^https?://) in addition to the existing FILTER_VALIDATE_URL validation. This prevents javascript: and other non-HTTP URI schemes from being rendered as clickable links, eliminating the stored XSS vector. The change is applied consistently in both the default theme and the Overmind theme.",
                "generatedAt": "2026-09-30T14:12:32.112077Z",
                "generator": "patch2vuln.py",
                "model": "qwen3.8:27b",
                "modelComparison": {
                  "rankings": [
                    {
                      "agreementScore": 9,
                      "assumptionCount": 5,
                      "confidence": "high",
                      "model": "qwen3.8:27b",
                      "score": 6
                    }
                  ],
                  "selectedModel": "qwen3.8:27b",
                  "selectionMethod": "deterministic-consensus-v1",
                  "selectionNotice": "The selected result is closest to model consensus; this heuristic does not establish factual correctness and human review remains required."
                },
                "patchSha256": "b68dbd6726929ff1680daeae2a273fc346e7075d7ded36195994315c19ccf278",
                "patchSummary": "Two view templates are modified. In app/View/GalaxyClusters/view.ctp, the source value is extracted into a local variable and the conditional for rendering an anchor tag now requires both FILTER_VALIDATE_URL and a preg_match against /^https?:\\/\\//i. In app/View/Themed/Overmind/Elements/GalaxyClusters/View/galaxy_clusters_general.ctp, the same preg_match guard is added to the existing FILTER_VALIDATE_URL check. Net effect: only http(s) URLs produce a clickable link; all other values (including javascript:) are rendered as plain escaped text.",
                "patchTruncated": false,
                "patches": [
                  {
                    "commit": "11852876773554d79ff57937a235d18a1e4473dc",
                    "patchSha256": "b68dbd6726929ff1680daeae2a273fc346e7075d7ded36195994315c19ccf278",
                    "source": "https://github.com/MISP/MISP/commit/118528767.patch",
                    "sourceUrl": "https://github.com/MISP/MISP/commit/118528767.patch",
                    "subject": "fix: [security] Link a galaxy cluster source only when it is"
                  }
                ],
                "source": "https://github.com/MISP/MISP/commit/118528767.patch",
                "subject": "fix: [security] Link a galaxy cluster source only when it is",
                "tagVersionBoundary": {
                  "commits_after_fix": 26,
                  "repository": "https://github.com/MISP/MISP",
                  "tag": "v2.5.48",
                  "version": "2.5.48",
                  "version_type": "semver"
                },
                "weaknessRationale": [
                  {
                    "cweId": "CWE-79",
                    "rationale": "The application renders user-controlled data (the galaxy cluster source field) into an HTML anchor tag without restricting the URI scheme to safe values. Although output is HTML-escaped via h(), the href attribute still accepts javascript: URIs, resulting in stored XSS. CWE-79 is the narrowest defensible mapping."
                  }
                ]
              }
            }
          },
          "recordType": "advisory",
          "vulnId": "GCVE-1-2026-20256"
        }
      ]
    }
  },
  "cveMetadata": {
    "assignerOrgId": "5a6e4751-2f3f-4070-9419-94fb35b644e8",
    "assignerShortName": "CIRCL",
    "cveId": "CVE-2026-103388",
    "datePublished": "2026-09-30T14:22:36.271Z",
    "dateReserved": "2026-09-30T14:22:32.098Z",
    "dateUpdated": "2026-09-30T15:28:06.980Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

Sightings

Author	Source	Type	Date	Other

Nomenclature

Seen: The vulnerability was mentioned, discussed, or observed by the user.
Confirmed: The vulnerability has been validated from an analyst's perspective.
Published Proof of Concept: A public proof of concept is available for this vulnerability.
Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
Not confirmed: The user expressed doubt about the validity of the vulnerability.
Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.

The MITRE ATT&CK techniques below are AI-generated suggestions, inferred from the description of the vulnerability by the CIRCL/vulnerability-attack-technique-classification-roberta-base model, served locally by ML-Gateway. They have not been verified by an analyst and are provided for guidance only.
The approach is described in our paper Mapping CVEs to MITRE ATT&CK Techniques: A Curated Gold-Set Classifier and the Limits of LLM-Assisted Label Expansion.
Browse all ATT&CK techniques and the vulnerabilities related to each.

Related by attack behaviour

Vulnerabilities whose description is nearest to this one in the vector space of the CIRCL/vulnerability-attack-technique-biencoder model. This is a similarity search over the bi-encoder space (plain cosine), not a classification, and it has no measured accuracy.

Action not permitted

GHSA-CCJM-JPCQ-P5HF

CVE-2026-103388 (GCVE-0-2026-103388)

Fix summary

Patch summary

CVSS rationale

Weakness rationale

Attack pattern rationale

Assumptions to verify

Model comparison

Tags

Sightings

Nomenclature

Related by attack behaviour