CVE-2026-53693

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-53693", "assignerOrgId": "5a6e4751-2f3f-4070-9419-94fb35b644e8", "state": "PUBLISHED", "assignerShortName": "CIRCL", "dateReserved": "2026-06-10T14:33:02.581Z", "datePublished": "2026-06-10T14:34:58.983Z", "dateUpdated": "2026-06-10T16:15:16.975Z"}, "containers": {"cna": {"affected": [{"defaultStatus": "unaffected", "product": "bsimvis", "repo": "https://github.com/MISP/bsimvis", "vendor": "misp", "versions": [{"lessThanOrEqual": "v0.2.0", "status": "affected", "version": "0", "versionType": "semver"}]}], "credits": [{"lang": "en", "type": "remediation developer", "value": "Thomas Caillet"}, {"lang": "en", "type": "finder", "value": "Alexandre Dulaunoy"}, {"lang": "en", "type": "finder", "value": "Codex GPT-5.5"}], "descriptions": [{"lang": "en", "supportingMedia": [{"base64": false, "type": "text/html", "value": "<p>A stored cross-site scripting vulnerability existed in MISP&nbsp;<strong>BSimVis</strong> tag rendering code. Several client-side rendering paths interpolated tag names, collection names, entity identifiers, cluster names, and tag metadata directly into HTML, HTML attributes, inline JavaScript event handlers, and CSS style values without context-appropriate escaping. The patch adds shared escaping helpers for HTML, attributes, JavaScript strings, and CSS color validation, then applies them across tag badges, tooltips, context menus, cluster cards, autocomplete suggestions, and dynamically inserted tag cards.</p><p>An attacker able to create or influence stored tag or metadata values could inject a crafted payload that is later rendered in another user\u2019s browser. Successful exploitation could execute arbitrary JavaScript in the victim\u2019s session when they view affected BSimVis pages, potentially allowing the attacker to perform actions as the victim, read data available to the victim, or alter displayed application content.<br><br></p><p>This issue affects MISP bsimvis: through v0.2.0.</p>"}], "value": "A stored cross-site scripting vulnerability existed in MISP\u00a0BSimVis tag rendering code. Several client-side rendering paths interpolated tag names, collection names, entity identifiers, cluster names, and tag metadata directly into HTML, HTML attributes, inline JavaScript event handlers, and CSS style values without context-appropriate escaping. The patch adds shared escaping helpers for HTML, attributes, JavaScript strings, and CSS color validation, then applies them across tag badges, tooltips, context menus, cluster cards, autocomplete suggestions, and dynamically inserted tag cards.\n\nAn attacker able to create or influence stored tag or metadata values could inject a crafted payload that is later rendered in another user\u2019s browser. Successful exploitation could execute arbitrary JavaScript in the victim\u2019s session when they view affected BSimVis pages, potentially allowing the attacker to perform actions as the victim, read data available to the victim, or alter displayed application content.\n\n\n\nThis issue affects MISP bsimvis: through v0.2.0."}], "impacts": [{"capecId": "CAPEC-18", "descriptions": [{"lang": "en", "value": "CAPEC-18 XSS Targeting Non-Script Elements"}]}, {"capecId": "CAPEC-243", "descriptions": [{"lang": "en", "value": "CAPEC-243 XSS Targeting HTML Attributes"}]}, {"capecId": "CAPEC-63", "descriptions": [{"lang": "en", "value": "CAPEC-63 Cross-Site Scripting (XSS)"}]}, {"capecId": "CAPEC-592", "descriptions": [{"lang": "en", "value": "CAPEC-592 Stored XSS"}]}], "metrics": [{"cvssV4_0": {"Automatable": "NOT_DEFINED", "Recovery": "NOT_DEFINED", "Safety": "NOT_DEFINED", "attackComplexity": "LOW", "attackRequirements": "NONE", "attackVector": "NETWORK", "baseScore": 6.9, "baseSeverity": "MEDIUM", "privilegesRequired": "NONE", "providerUrgency": "NOT_DEFINED", "subAvailabilityImpact": "NONE", "subConfidentialityImpact": "LOW", "subIntegrityImpact": "NONE", "userInteraction": "NONE", "valueDensity": "NOT_DEFINED", "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:L/SI:N/SA:N", "version": "4.0", "vulnAvailabilityImpact": "NONE", "vulnConfidentialityImpact": "LOW", "vulnIntegrityImpact": "NONE", "vulnerabilityResponseEffort": "NOT_DEFINED"}, "format": "CVSS", "scenarios": [{"lang": "en", "value": "GENERAL"}]}], "problemTypes": [{"descriptions": [{"cweId": "CWE-79", "description": "CWE-79 Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting')", "lang": "en", "type": "CWE"}]}, {"descriptions": [{"cweId": "CWE-116", "description": "CWE-116 Improper Encoding or Escaping of Output", "lang": "en", "type": "CWE"}]}], "providerMetadata": {"orgId": "5a6e4751-2f3f-4070-9419-94fb35b644e8", "shortName": "CIRCL", "dateUpdated": "2026-06-10T14:34:58.983Z"}, "references": [{"tags": ["patch"], "url": "https://github.com/MISP/bsimvis/commit/7bcd2c2e27647dccdfb71877e905fbb032124a63"}], "source": {"discovery": "UNKNOWN"}, "title": "MISP BSimVis stored cross-site scripting in tag and cluster rendering paths via unescaped tag metadata and UI labels", "x_generator": {"engine": "Vulnogram 0.2.0"}}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2026-06-10T16:15:08.009690Z", "id": "CVE-2026-53693", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-06-10T16:15:16.975Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2026-53693", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2026-06-10T16:15:08.009690Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-06-10T16:15:13.469Z"}}], "cna": {"title": "MISP BSimVis stored cross-site scripting in tag and cluster rendering paths via unescaped tag metadata and UI labels", "source": {"discovery": "UNKNOWN"}, "credits": [{"lang": "en", "type": "remediation developer", "value": "Thomas Caillet"}, {"lang": "en", "type": "finder", "value": "Alexandre Dulaunoy"}, {"lang": "en", "type": "finder", "value": "Codex GPT-5.5"}], "impacts": [{"capecId": "CAPEC-18", "descriptions": [{"lang": "en", "value": "CAPEC-18 XSS Targeting Non-Script Elements"}]}, {"capecId": "CAPEC-243", "descriptions": [{"lang": "en", "value": "CAPEC-243 XSS Targeting HTML Attributes"}]}, {"capecId": "CAPEC-63", "descriptions": [{"lang": "en", "value": "CAPEC-63 Cross-Site Scripting (XSS)"}]}, {"capecId": "CAPEC-592", "descriptions": [{"lang": "en", "value": "CAPEC-592 Stored XSS"}]}], "metrics": [{"format": "CVSS", "cvssV4_0": {"Safety": "NOT_DEFINED", "version": "4.0", "Recovery": "NOT_DEFINED", "baseScore": 6.9, "Automatable": "NOT_DEFINED", "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "valueDensity": "NOT_DEFINED", "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:L/SI:N/SA:N", "providerUrgency": "NOT_DEFINED", "userInteraction": "NONE", "attackComplexity": "LOW", "attackRequirements": "NONE", "privilegesRequired": "NONE", "subIntegrityImpact": "NONE", "vulnIntegrityImpact": "NONE", "subAvailabilityImpact": "NONE", "vulnAvailabilityImpact": "NONE", "subConfidentialityImpact": "LOW", "vulnConfidentialityImpact": "LOW", "vulnerabilityResponseEffort": "NOT_DEFINED"}, "scenarios": [{"lang": "en", "value": "GENERAL"}]}], "affected": [{"repo": "https://github.com/MISP/bsimvis", "vendor": "misp", "product": "bsimvis", "versions": [{"status": "affected", "version": "0", "versionType": "semver", "lessThanOrEqual": "v0.2.0"}], "defaultStatus": "unaffected"}], "references": [{"url": "https://github.com/MISP/bsimvis/commit/7bcd2c2e27647dccdfb71877e905fbb032124a63", "tags": ["patch"]}], "x_generator": {"engine": "Vulnogram 0.2.0"}, "descriptions": [{"lang": "en", "value": "A stored cross-site scripting vulnerability existed in MISP\u00a0BSimVis tag rendering code. Several client-side rendering paths interpolated tag names, collection names, entity identifiers, cluster names, and tag metadata directly into HTML, HTML attributes, inline JavaScript event handlers, and CSS style values without context-appropriate escaping. The patch adds shared escaping helpers for HTML, attributes, JavaScript strings, and CSS color validation, then applies them across tag badges, tooltips, context menus, cluster cards, autocomplete suggestions, and dynamically inserted tag cards.\n\nAn attacker able to create or influence stored tag or metadata values could inject a crafted payload that is later rendered in another user\u2019s browser. Successful exploitation could execute arbitrary JavaScript in the victim\u2019s session when they view affected BSimVis pages, potentially allowing the attacker to perform actions as the victim, read data available to the victim, or alter displayed application content.\n\n\n\nThis issue affects MISP bsimvis: through v0.2.0.", "supportingMedia": [{"type": "text/html", "value": "<p>A stored cross-site scripting vulnerability existed in MISP&nbsp;<strong>BSimVis</strong> tag rendering code. Several client-side rendering paths interpolated tag names, collection names, entity identifiers, cluster names, and tag metadata directly into HTML, HTML attributes, inline JavaScript event handlers, and CSS style values without context-appropriate escaping. The patch adds shared escaping helpers for HTML, attributes, JavaScript strings, and CSS color validation, then applies them across tag badges, tooltips, context menus, cluster cards, autocomplete suggestions, and dynamically inserted tag cards.</p><p>An attacker able to create or influence stored tag or metadata values could inject a crafted payload that is later rendered in another user\u2019s browser. Successful exploitation could execute arbitrary JavaScript in the victim\u2019s session when they view affected BSimVis pages, potentially allowing the attacker to perform actions as the victim, read data available to the victim, or alter displayed application content.<br><br></p><p>This issue affects MISP bsimvis: through v0.2.0.</p>", "base64": false}]}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-79", "description": "CWE-79 Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting')"}]}, {"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-116", "description": "CWE-116 Improper Encoding or Escaping of Output"}]}], "providerMetadata": {"orgId": "5a6e4751-2f3f-4070-9419-94fb35b644e8", "shortName": "CIRCL", "dateUpdated": "2026-06-10T14:34:58.983Z"}}}, "cveMetadata": {"cveId": "CVE-2026-53693", "state": "PUBLISHED", "dateUpdated": "2026-06-10T16:15:16.975Z", "dateReserved": "2026-06-10T14:33:02.581Z", "assignerOrgId": "5a6e4751-2f3f-4070-9419-94fb35b644e8", "datePublished": "2026-06-10T14:34:58.983Z", "assignerShortName": "CIRCL"}, "dataVersion": "5.2"}

{"affected": [{"affectedData": [{"defaultStatus": "unaffected", "product": "bsimvis", "repo": "https://github.com/MISP/bsimvis", "vendor": "misp", "versions": [{"lessThanOrEqual": "v0.2.0", "status": "affected", "version": "0", "versionType": "semver"}]}], "source": "5a6e4751-2f3f-4070-9419-94fb35b644e8"}], "cveTags": [], "descriptions": [{"lang": "en", "value": "A stored cross-site scripting vulnerability existed in MISP\u00a0BSimVis tag rendering code. Several client-side rendering paths interpolated tag names, collection names, entity identifiers, cluster names, and tag metadata directly into HTML, HTML attributes, inline JavaScript event handlers, and CSS style values without context-appropriate escaping. The patch adds shared escaping helpers for HTML, attributes, JavaScript strings, and CSS color validation, then applies them across tag badges, tooltips, context menus, cluster cards, autocomplete suggestions, and dynamically inserted tag cards.\n\nAn attacker able to create or influence stored tag or metadata values could inject a crafted payload that is later rendered in another user\u2019s browser. Successful exploitation could execute arbitrary JavaScript in the victim\u2019s session when they view affected BSimVis pages, potentially allowing the attacker to perform actions as the victim, read data available to the victim, or alter displayed application content.\n\n\n\nThis issue affects MISP bsimvis: through v0.2.0."}, {"lang": "es", "value": "Una vulnerabilidad de cross-site scripting almacenado exist\u00eda en el c\u00f3digo de renderizado de etiquetas de MISP BSimVis. Varias rutas de renderizado del lado del cliente interpolaban nombres de etiquetas, nombres de colecciones, identificadores de entidades, nombres de cl\u00fasteres y metadatos de etiquetas directamente en HTML, atributos HTML, manejadores de eventos JavaScript en l\u00ednea y valores de estilo CSS sin el escape apropiado para el contexto. El parche a\u00f1ade ayudantes de escape compartidos para HTML, atributos, cadenas JavaScript y validaci\u00f3n de color CSS, luego los aplica a trav\u00e9s de insignias de etiquetas, tooltips, men\u00fas contextuales, tarjetas de cl\u00faster, sugerencias de autocompletado y tarjetas de etiquetas insertadas din\u00e1micamente.\n\nUn atacante capaz de crear o influir en valores de etiquetas o metadatos almacenados podr\u00eda inyectar una carga \u00fatil manipulada que luego se renderiza en el navegador de otro usuario. La explotaci\u00f3n exitosa podr\u00eda ejecutar JavaScript arbitrario en la sesi\u00f3n de la v\u00edctima cuando visualizan p\u00e1ginas BSimVis afectadas, lo que podr\u00eda permitir al atacante realizar acciones como la v\u00edctima, leer datos disponibles para la v\u00edctima o alterar el contenido de la aplicaci\u00f3n mostrado.\n\nEste problema afecta a MISP bsimvis: hasta la v0.2.0."}], "id": "CVE-2026-53693", "lastModified": "2026-10-26T11:10:00.157", "metrics": {"cvssMetricV40": [{"cvssData": {"Automatable": "NOT_DEFINED", "Recovery": "NOT_DEFINED", "Safety": "NOT_DEFINED", "attackComplexity": "LOW", "attackRequirements": "NONE", "attackVector": "NETWORK", "availabilityRequirement": "NOT_DEFINED", "baseScore": 6.9, "baseSeverity": "MEDIUM", "confidentialityRequirement": "NOT_DEFINED", "exploitMaturity": "NOT_DEFINED", "integrityRequirement": "NOT_DEFINED", "modifiedAttackComplexity": "NOT_DEFINED", "modifiedAttackRequirements": "NOT_DEFINED", "modifiedAttackVector": "NOT_DEFINED", "modifiedPrivilegesRequired": "NOT_DEFINED", "modifiedSubAvailabilityImpact": "NOT_DEFINED", "modifiedSubConfidentialityImpact": "NOT_DEFINED", "modifiedSubIntegrityImpact": "NOT_DEFINED", "modifiedUserInteraction": "NOT_DEFINED", "modifiedVulnAvailabilityImpact": "NOT_DEFINED", "modifiedVulnConfidentialityImpact": "NOT_DEFINED", "modifiedVulnIntegrityImpact": "NOT_DEFINED", "privilegesRequired": "NONE", "providerUrgency": "NOT_DEFINED", "subAvailabilityImpact": "NONE", "subConfidentialityImpact": "LOW", "subIntegrityImpact": "NONE", "userInteraction": "NONE", "valueDensity": "NOT_DEFINED", "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:L/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X", "version": "4.0", "vulnAvailabilityImpact": "NONE", "vulnConfidentialityImpact": "LOW", "vulnIntegrityImpact": "NONE", "vulnerabilityResponseEffort": "NOT_DEFINED"}, "source": "5a6e4751-2f3f-4070-9419-94fb35b644e8", "type": "Secondary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-53693", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "partial"}], "role": "CISA Coordinator", "timestamp": "2026-06-10T16:15:08.009690Z", "version": "2.0.3"}}]}, "published": "2026-06-10T16:17:16.917", "references": [{"source": "5a6e4751-2f3f-4070-9419-94fb35b644e8", "url": "https://github.com/MISP/bsimvis/commit/7bcd2c2e27647dccdfb71877e905fbb032124a63"}], "sourceIdentifier": "5a6e4751-2f3f-4070-9419-94fb35b644e8", "vulnStatus": "Deferred", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-79"}, {"lang": "en", "value": "CWE-116"}], "source": "5a6e4751-2f3f-4070-9419-94fb35b644e8", "type": "Secondary"}]}

{}

{"affected": [{"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "generic", "value": "[0,v0.2.0]"}}], "enrichment": {"confidence": 100.0, "confidence_source": "cna", "scores": [{"score": 100.0, "source": "cna"}]}, "original": {"product": "bsimvis", "source": "cna", "vendor": "misp"}, "product": "bsimvis", "vendor": "misp"}], "created": "2026-06-10T18:15:17.026568+00:00", "updated": "2026-06-11T10:41:37.656925+00:00", "vendors": ["misp", "misp$PRODUCT$bsimvis"]}