CVE-2026-94373

Reference list NVD curates from the CNA record, vendor advisories, and third-party reports. The tag chips below are NVD's analyst-assigned categories.

• https://github.com/MISP/MISP/commit/b062698f2 5a6e4751-2f3f-4070-9419-94fb35b644e8

The full cvelistV5 record. Download as CVE-2026-94373.json.

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-94373",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-09-21T15:22:19.064596Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-09-21T15:22:31.730Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "modules": [
            "app/webroot/js/contextual_menu.js"
          ],
          "product": "MISP",
          "programFiles": [
            "app/webroot/js/contextual_menu.js"
          ],
          "repo": "https://github.com/MISP/MISP",
          "vendor": "MISP",
          "versions": [
            {
              "lessThan": "2.5.47",
              "status": "affected",
              "version": "0",
              "versionType": "semver"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "remediation developer",
          "value": "iglocska"
        },
        {
          "lang": "en",
          "type": "finder",
          "value": "Jeroen Pinoy"
        },
        {
          "lang": "en",
          "type": "finder",
          "value": "David Andre"
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "supportingMedia": [
            {
              "base64": false,
              "type": "text/html",
              "value": "<p>MISP contains a DOM-based cross-site scripting (XSS) vulnerability in the contextual menu JavaScript component. The ContextualMenu class populates HTML &lt;option&gt; elements by assigning user-controllable values to the innerHTML property. Because innerHTML parses and renders HTML markup, any untrusted string supplied as the option text (value.text or value) is interpreted as live DOM content rather than plain text. An attacker who can influence the data rendered in the contextual menu can inject arbitrary HTML or JavaScript that executes in the victim's browser within the MISP application origin. This may allow session hijacking, data exfiltration, or unauthorized actions performed on behalf of the authenticated user.</p><p>Version affected: &lt;2.5.47</p>"
            }
          ],
          "value": "MISP contains a DOM-based cross-site scripting (XSS) vulnerability in the contextual menu JavaScript component. The ContextualMenu class populates HTML <option> elements by assigning user-controllable values to the innerHTML property. Because innerHTML parses and renders HTML markup, any untrusted string supplied as the option text (value.text or value) is interpreted as live DOM content rather than plain text. An attacker who can influence the data rendered in the contextual menu can inject arbitrary HTML or JavaScript that executes in the victim's browser within the MISP application origin. This may allow session hijacking, data exfiltration, or unauthorized actions performed on behalf of the authenticated user.\n\nVersion affected: <2.5.47"
        }
      ],
      "impacts": [
        {
          "capecId": "CAPEC-12",
          "descriptions": [
            {
              "lang": "en",
              "value": "CAPEC-12 DOM-based XSS"
            }
          ]
        }
      ],
      "metrics": [
        {
          "cvssV4_0": {
            "Automatable": "NOT_DEFINED",
            "Recovery": "NOT_DEFINED",
            "Safety": "NOT_DEFINED",
            "attackComplexity": "LOW",
            "attackRequirements": "NONE",
            "attackVector": "NETWORK",
            "baseScore": 6.3,
            "baseSeverity": "MEDIUM",
            "privilegesRequired": "LOW",
            "providerUrgency": "NOT_DEFINED",
            "subAvailabilityImpact": "NONE",
            "subConfidentialityImpact": "HIGH",
            "subIntegrityImpact": "HIGH",
            "userInteraction": "PASSIVE",
            "valueDensity": "NOT_DEFINED",
            "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:P/VC:N/VI:N/VA:N/SC:H/SI:H/SA:N",
            "version": "4.0",
            "vulnAvailabilityImpact": "NONE",
            "vulnConfidentialityImpact": "NONE",
            "vulnIntegrityImpact": "NONE",
            "vulnerabilityResponseEffort": "NOT_DEFINED"
          },
          "format": "CVSS",
          "scenarios": [
            {
              "lang": "en",
              "value": "GENERAL"
            }
          ]
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-79",
              "description": "CWE-79 Cross-site Scripting (XSS)",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-09-21T12:16:47.877Z",
        "orgId": "5a6e4751-2f3f-4070-9419-94fb35b644e8",
        "shortName": "CIRCL"
      },
      "references": [
        {
          "name": "Security patch",
          "tags": [
            "patch"
          ],
          "url": "https://github.com/MISP/MISP/commit/b062698f2"
        }
      ],
      "solutions": [
        {
          "lang": "en",
          "supportingMedia": [
            {
              "base64": false,
              "type": "text/html",
              "value": "<p>The vulnerability is remediated by replacing the unsafe innerHTML property assignments with the safe textContent property when setting the display text of dynamically created &lt;option&gt; elements. textContent inserts the value as plain text without parsing HTML, thereby neutralizing any injected markup or script.</p>"
            }
          ],
          "value": "The vulnerability is remediated by replacing the unsafe innerHTML property assignments with the safe textContent property when setting the display text of dynamically created <option> elements. textContent inserts the value as plain text without parsing HTML, thereby neutralizing any injected markup or script."
        }
      ],
      "title": "MISP DOM-based Cross-Site Scripting via innerHTML in Contextual Menu",
      "x_gcve": [
        {
          "extensions": {
            "bcp-05-x-01": {
              "ai_annotations": [
                {
                  "ai_level": "generated",
                  "description": "Draft vulnerability metadata was generated from a git-format patch using an Ollama-hosted language model. Human validation is required before publication.",
                  "gna_source": 1,
                  "models": [
                    {
                      "gna_source": 1,
                      "identifier": "qwen3.8:27b",
                      "name": "qwen3.8:27b",
                      "source": "ollama"
                    }
                  ],
                  "review_status": "review",
                  "scope": "record",
                  "tags": [
                    "ai-computer-assisted:llm-generated",
                    "ai-computer-assisted:classification"
                  ]
                }
              ]
            },
            "bcp-05-x-02": {
              "x_patch2vuln": {
                "assumptions": [
                  "The affected version range is inferred from the tag_version_boundary (v2.5.47 with 137 commits after the fix), suggesting the fix landed shortly after v2.5.47; no explicit affected/fixed version strings are provided in the metadata.",
                  "PR:L assumes the attacker must be an authenticated MISP user to inject data that reaches the contextual menu; if an unauthenticated injection path exists, PR could be N.",
                  "UI:P assumes the victim must actively open or interact with the contextual menu for the XSS to trigger; if the menu renders automatically on page load, UI could be N.",
                  "The CAPEC-12 mapping is high-confidence based on the innerHTML-to-textContent pattern, but the exact data flow (which upstream field feeds value.text) is not visible in the patch.",
                  "AT:N assumes the attacker does not need to target a specific user's session; if the payload must be tailored to a particular user's view, AT could be P."
                ],
                "capecRationale": [
                  {
                    "capecId": "CAPEC-12",
                    "rationale": "The vulnerability is a textbook DOM-based XSS: attacker-controlled data is written into the DOM via the innerHTML property, causing the browser to parse and execute injected markup/script. CAPEC-12 (DOM-based XSS) is the most precise CAPEC pattern. The mapping is high-confidence because the patch explicitly targets innerHTML-to-textContent in a client-side JS file, which is the defining characteristic of DOM-based XSS."
                  }
                ],
                "commit": "b062698f269996ffe3ceb23de78612d768a3bfe2",
                "confidence": "medium",
                "credits": [
                  {
                    "lang": "en",
                    "type": "remediation developer",
                    "value": "iglocska"
                  }
                ],
                "cvssRationale": "AV:N: MISP is a network-accessible web application. AC:L: The injection is straightforward once attacker-controlled data reaches the menu options. AT:N: No special targeting of a specific session state is required beyond the data being rendered. PR:L: The attacker must be authenticated to MISP to inject data that will be rendered in the contextual menu. UI:P: The victim must interact with the contextual menu (e.g., open it) for the injected content to execute. VC/VI/VA:N: The MISP server itself is not directly compromised. SC:H/SI:H: The victim's browser (subsequent component) suffers high confidentiality and integrity impact via script execution in the MISP origin. SA:N: Availability of the browser is not impacted.",
                "draft": false,
                "fixSummary": "The vulnerability is remediated by replacing the unsafe innerHTML property assignments with the safe textContent property when setting the display text of dynamically created <option> elements. textContent inserts the value as plain text without parsing HTML, thereby neutralizing any injected markup or script.",
                "generatedAt": "2026-09-21T12:08:13.810140Z",
                "generator": "patch2vuln.py",
                "model": "qwen3.8:27b",
                "modelComparison": {
                  "rankings": [
                    {
                      "agreementScore": 9,
                      "assumptionCount": 5,
                      "confidence": "medium",
                      "model": "qwen3.8:27b",
                      "score": 5
                    }
                  ],
                  "selectedModel": "qwen3.8:27b",
                  "selectionMethod": "deterministic-consensus-v1",
                  "selectionNotice": "The selected result is closest to model consensus; this heuristic does not establish factual correctness and human review remains required."
                },
                "patchSha256": "843bc32d5dc337c115c79558f499550f4659a063b250fca808e32725cd586c9f",
                "patchSummary": "In app/webroot/js/contextual_menu.js, within the ContextualMenu class, two lines that set option.innerHTML (one for object-valued entries using value.text and one for scalar entries using value) are changed to option.textContent. No other logic, event handlers, or surrounding code is modified. The change is limited to the two assignment statements in the option-population loop.",
                "patchTruncated": false,
                "patches": [
                  {
                    "commit": "b062698f269996ffe3ceb23de78612d768a3bfe2",
                    "patchSha256": "843bc32d5dc337c115c79558f499550f4659a063b250fca808e32725cd586c9f",
                    "source": "https://github.com/MISP/MISP/commit/b062698f2.patch",
                    "sourceUrl": "https://github.com/MISP/MISP/commit/b062698f2.patch",
                    "subject": "fix: [xss] via JS innerHTML - as reported by David Andre and"
                  }
                ],
                "source": "https://github.com/MISP/MISP/commit/b062698f2.patch",
                "subject": "fix: [xss] via JS innerHTML - as reported by David Andre and",
                "tagVersionBoundary": {
                  "commits_after_fix": 137,
                  "repository": "https://github.com/MISP/MISP",
                  "tag": "v2.5.47",
                  "version": "2.5.47",
                  "version_type": "semver"
                },
                "weaknessRationale": [
                  {
                    "cweId": "CWE-79",
                    "rationale": "The patch replaces innerHTML with textContent to prevent HTML/JS injection into the DOM, which is the canonical remediation for DOM-based XSS (CWE-79). The specific sub-type is DOM-based XSS via unsafe DOM API usage (innerHTML), but CWE-79 is the narrowest standard identifier that covers this."
                  }
                ]
              }
            }
          },
          "recordType": "advisory",
          "vulnId": "GCVE-1-2026-20033"
        }
      ]
    }
  },
  "cveMetadata": {
    "assignerOrgId": "5a6e4751-2f3f-4070-9419-94fb35b644e8",
    "assignerShortName": "CIRCL",
    "cveId": "CVE-2026-94373",
    "datePublished": "2026-09-21T12:16:47.877Z",
    "dateReserved": "2026-09-21T12:16:44.364Z",
    "dateUpdated": "2026-09-21T15:22:31.730Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}