Medium · CVSS 5.1CVE-2026-104901

MISP ID Translator: Unescaped Remote Event ID Enables Cross-Site Scripting via Linked Server

Answer in brief

CVE-2026-104901 records a Medium severity (CVSS 5.1) vulnerability in MISP ID Translator: Unescaped Remote Event ID Enables Cross-Site Scripting via Linked Server. The current sources do not mark it as known exploited. The current feed maps MISP/MISP (generic). Check affected ranges and fixed versions before updating.

Analysis pending evidence review

HOL Guard separates source facts from reviewed analysis. See the methodology.

Published Oct 2, 2026Updated Oct 2, 2026Source checked Oct 2, 2026First seen by HOL Oct 2, 2026Material review Oct 2, 2026

Upstream Advisory

Key facts

Risk: Medium · CVSS 5.1
Exploitation: Not marked as known exploited
Affected software: 1 mapped package or product
Fix availability: Available

Why this deserves its current priority

CVSS is 5.1. The current sources do not mark it as known exploited. Treat this as a source-backed prioritization signal, not a statement about your environment.

Analysis status

Analysis pending evidence review

Factual feed record only; HOL analysis is not approved for indexing. Read the methodology.

Affected scope and exposure questions

The current feed maps MISP/MISP (generic). Check affected ranges and fixed versions before updating.

Mapped affected packages and fixed versions
Package	Affected range	Fixed version
MISP/MISPgeneric	>=0 <2.5.48	2.5.48

Recommended response

Check inventory. Check lockfiles and deployed manifests for MISP/MISP.
Review the reported fix. Source-reported solution: The vulnerability is remediated by enforcing integer typing on the remote event ID at the point where it enters the application data structure in the controller, and by applying HTML output encoding (the h() helper) to all user-visible fields (remote_id, server_id) in both the default and Overmind-themed ID Translator views. This ensures that even if a remote server returns non-numeric or markup-laden data, it cannot be interpreted as HTML by the browser.

Evidence timeline and material changes

Published upstream
Oct 2, 2026
Evidence: source:cvelist:source_dates:source-dates:record
Source modified
Oct 2, 2026
Evidence: source:cvelist:source_dates:source-dates:record
First seen by HOL
Oct 2, 2026

Sources and claim methodology

GitHub security advisorygithub.com

Upstream source description

MISP contains a cross-site scripting (XSS) vulnerability in the ID Translator feature. When a user views the ID Translator page, the application queries linked (remote) MISP servers for corresponding event identifiers. The event ID returned by the remote server was rendered in the HTML output without proper output encoding. A malicious or compromised linked server could return a crafted event ID containing arbitrary HTML or JavaScript markup. This markup would be rendered in the browser of any user in the host organization who views the ID Translator page, enabling session hijacking, credential theft, or other client-side attacks. Preconditions: - The victim must be an authenticated user of the host MISP instance. - A linked server must be configured on the host instance. - The victim must navigate to the ID Translator page for a given event. Affected versions: <2.5.48.

Quoted source text, attributed separately from HOL analysis.