GCVE-1-2026-20241 — MISP reflected cross-site scripting via unsanitized analyst data seed parameter

MISP analyst data views reflected a user-supplied seed parameter without sanitization into an inline JavaScript context in the HTML response, enabling reflected XSS. The attacker needs at least a low-privilege authenticated account or must target an authenticated user, and the victim must navigate to the malicious URL. The source states that a fix was developed, but the exact fixed version is not specified.