The vulnerability in MISP involves improper HTML encoding of the event identifier field in the remote event preview index table. While the associated link URL is escaped, the field value itself is rendered without HTML encoding. An attacker who can create or modify events on a linked remote MISP server can insert HTML or JavaScript code into the event identifier. When a user on the local MISP instance views this remote event preview, the unescaped malicious code executes in their browser, enabling cross-site scripting attacks. Preconditions include a configured linked remote MISP server and attacker write access on that server. The vulnerability is identified as CVE-2026-104900 and affects versions before 2.5.48.

Successful exploitation allows execution of arbitrary JavaScript in the context of the MISP web application for the victim user. This can result in session hijacking, unauthorized actions performed with the victim's privileges, and potential data exfiltration. The attack requires the attacker to have write access on a linked remote MISP server and the victim to view the remote event preview index page.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, restrict write access on linked remote MISP servers to trusted users only and avoid viewing remote event previews from untrusted sources.