CVE-2026-88921

MISP contains an HTML injection vulnerability in the MISPElementHTMLFormatterTool component, which is responsible for rendering MISP element references (attributes, objects, and tags) into inline HTML during PDF report export via the convert_markdown_to_pdf module. The attribute(), objectAttribute(), object(), and tag() methods interpolated user-controlled fields (attribute type, attribute value, object name, object relation, tag name, tag colour, and tag text colour) directly into HTML templates without applying HTML entity encoding. An authenticated user with the ability to create or modify MISP attributes, objects, or tags could embed arbitrary HTML markup in these fields. When a report containing such elements was exported to PDF, the unescaped content was rendered as live HTML rather than inert text, potentially injecting script tags, breaking the document structure, or altering the visual content of the exported report. Additionally, the attribute() method contained a template with hardcoded sample values ("domain-ip" and "google.com") instead of format placeholders, meaning every plain attribute reference in a PDF displayed the sample text rather than the actual indicator value, constituting a data-integrity defect in the exported document. The vulnerability requires an authenticated actor with write access to MISP elements and a subsequent PDF export of a report referencing those elements. The security impact is primarily to the integrity of the exported document and, depending on the HTML-to-PDF rendering engine, potential execution of injected markup during the conversion step. Version affected: ≤2.5.45

• CWE-79
• CWE-116

• https://github.com/MISP/MISP/commit/949744a4b

Published

Sep 10, 2026

Last Modified

Sep 10, 2026

Status

Deferred

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2026-88910The kboard WordPress plugin before 6.7 does not verify owner…5.3
• CVE-2026-88912The rtMedia for WordPress, BuddyPress and bbPress WordPress …4.2
• CVE-2026-88914A flaw was found in GStreamer's gst-plugins-good isomp4 plug…4.4
• CVE-2026-88915Affected versions of MISP do not consistently enforce the ac…7.1
• CVE-2026-88916Incorrect Authorization vulnerability in TÜBİTAK ULAKBİM Ula…6.8
• CVE-2026-8892The CM Business Directory – Optimise and showcase local busi…6.4
• CVE-2026-88922The go-getter library up to versions 1.8.8 and 2.2.3 is vuln…6.7
• CVE-2026-88924A flaw was found in the admin backend of gvfs. The privilege…7
• CVE-2026-88926The VikRentItems Flexible Rental Management System WordPress…8.6
• CVE-2026-88929The Product Badge, Label, Countdown Timer for WooCommerce W…5.3
• CVE-2026-8893The Express Payment For Stripe plugin for WordPress is vulne…6.4
• CVE-2026-88932multer is a Node.js middleware for handling multipart/form-d…5.3