CVE-2026-53693
MediumCVSS 6.9Exploitation Probability (EPSS)
Low risk15th percentile — higher than 15% of all known CVEs
Summary
A stored cross-site scripting (XSS) vulnerability exists in the tag rendering code of MISP BSimVis. Several client-side rendering paths interpolate tag names, collection names, entity identifiers, cluster names, and tag metadata without appropriate context, allowing attackers to inject malicious code.
Risk Assessment
Attackers could exploit this vulnerability to inject malicious JavaScript that executes in the victim's session, potentially leading to unauthorized access to data or alteration of application content.
Recommendation
It is recommended to update MISP BSimVis to a version that includes security patches to mitigate the risks associated with this vulnerability.
Original NVD description (English source)
A stored cross-site scripting vulnerability existed in MISP BSimVis tag rendering code. Several client-side rendering paths interpolated tag names, collection names, entity identifiers, cluster names, and tag metadata directly into HTML, HTML attributes, inline JavaScript event handlers, and CSS style values without context-appropriate escaping. The patch adds shared escaping helpers for HTML, attributes, JavaScript strings, and CSS color validation, then applies them across tag badges, tooltips, context menus, cluster cards, autocomplete suggestions, and dynamically inserted tag cards. An attacker able to create or influence stored tag or metadata values could inject a crafted payload that is later rendered in another user’s browser. Successful exploitation could execute arbitrary JavaScript in the victim’s session when they view affected BSimVis pages, potentially allowing the attacker to perform actions as the victim, read data available to the victim, or alter displayed application content. This issue affects MISP bsimvis: through v0.2.0.