The vulnerability CVE-2026-53693 in MISP bsimvis (versions up to 0.2.0) is a stored cross-site scripting flaw caused by the lack of context-appropriate escaping of user-controllable data in various client-side rendering paths. Specifically, tag-related data is interpolated directly into HTML, HTML attributes, inline JavaScript event handlers, and CSS style values without proper escaping, enabling injection of arbitrary JavaScript. Successful exploitation allows execution of attacker-controlled scripts in the context of other users' sessions, potentially leading to unauthorized actions, data disclosure, or content manipulation. The patch described adds escaping helpers for HTML, attributes, JavaScript strings, and CSS color validation, but no official fix or vendor advisory is currently available. The CVSS 4.0 vector indicates network attack vector, low complexity, no privileges or user interaction required, and low impact on confidentiality, integrity, and availability.

An attacker capable of creating or influencing stored tag or metadata values in MISP bsimvis up to version 0.2.0 can inject malicious JavaScript payloads that execute in the browsers of other users viewing affected pages. This can lead to unauthorized actions performed on behalf of the victim, disclosure of sensitive information accessible to the victim, or alteration of displayed application content. The vulnerability does not require privileges or user interaction to exploit and can be triggered remotely over the network.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. The description mentions a patch that adds shared escaping helpers and applies them across affected components, but no official patch or vendor advisory is provided. Until an official fix is released, users should avoid using affected versions (<=0.2.0) or restrict the ability to create or modify tags and metadata to trusted users only to reduce risk.