CVE-2026-85230

A persistent unsafe URL injection vulnerability exists in the MISP dashboard ButtonWidget configuration. Dashboard widget URLs were validated only when the widget was rendered and were not validated when the configuration was saved. As a result, an authenticated user able to modify dashboard widget settings could persist arbitrary URL values, including URLs using the javascript: scheme, through either of the dashboard settings persistence paths. A malicious javascript: URL stored in a dashboard button could potentially result in client-side script execution in the MISP security context if the value reached a rendering or navigation path without the existing runtime validation. Such execution could allow an attacker to perform actions with the privileges of the affected user or access information available to their MISP session. The practical exploitability of this issue is reduced by the fact that MISP already applied URL validation at render time, which neutralized known malicious values before they were presented to the user. The vulnerability therefore represents a persistence-layer validation gap and a defense-in-depth weakness rather than evidence of a direct bypass of the existing rendering protection. The patch introduces a canonical url schema type and validates dashboard widget configuration before it is persisted through either settings save mechanism. ButtonWidget URLs must now be strings resolving to an absolute path on the current MISP instance or a full URL with the same origin. Values using javascript:, external origins, malformed URL forms, and non-string values are rejected at save time.

• CWE-20
• CWE-79

• https://github.com/MISP/MISP/commit/f04b10001Patch

Published

Sep 3, 2026

Last Modified

Sep 10, 2026

Status

Analyzed

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2026-85225A vulnerability was identified in code-projects Doctor Appoi…7.3
• CVE-2026-85226MISP contains an authorization flaw in the OnDemand correlat…4.3
• CVE-2026-85227MISP contains a reflected Cross-Site Scripting (XSS) vulnera…6.1
• CVE-2026-85228An integer overflow in the tensor buffer validation componen…9.1
• CVE-2026-85229** UNSUPPORTED WHEN ASSIGNED ** Improper neutralization of i…6.1
• CVE-2026-8523Use after free in Mojo in Google Chrome prior to 148.0.7778.…8.3
• CVE-2026-85231A flaw was found in libtirpc. An authenticated remote attack…6.5
• CVE-2026-85234A flaw was found in tftp-hpa. When the `in.tftpd` remap engi…7.5
• CVE-2026-85235The Forminator Forms – Contact Form, Payment Form & Custom F…7.2
• CVE-2026-85236A cross-site request forgery (CSRF) vulnerability existed in…8.8
• CVE-2026-85237A vulnerability in MISP's email-based one-time password (OTP…8.1
• CVE-2026-85238MISP contains a session fixation vulnerability in the Custom…6.8