MISP 2.5.28 patches multiple XSS flaws

MISP 2.5.28 addresses critical XSS vulnerabilities across dashboard, sharing groups, and workflow components while upgrading to Gridstack 12.

The MISP Project released version 2.5.28 on December 10, 2025, delivering critical security patches for multiple cross-site scripting (XSS) vulnerabilities identified across the platform. The affected components include the world map view dashboard widget, sharing group edit functionality, workflow execution paths, and the actions table element. Several of the patched XSS issues are characterized as low-impact but required site administrator privileges or user interaction to exploit. The release also addresses a reflected XSS vulnerability in the preview index and tightens HTTP method validation platform-wide.

Beyond security fixes, this release introduces a major upgrade to Gridstack 12 for the dashboard framework, requiring extensive adjustments to widget configuration and behavior. Platform stability improvements include refined tag filtering logic that optimizes query performance by intelligently choosing between UNION and EXISTS operations based on attribute filter complexity. The Meta Communities review process has been enhanced to ensure shared events follow best practices, including proper use of object templates and sharing groups.

Additional improvements include updated dependencies (CakePHP and misp-taxonomies), redacted creator information in collections for non-site administrators, fixes to enrichment module exception handling, and corrections to proposal synchronization that now properly captures organization context during PUSH operations. The release also adds OpenBSD 7.8 installation documentation and includes the Slovak CSIRT.SK MISP Community in default configurations.

Source reporting: https://www.misp-project.org/2025/12/11/misp.2.5.28.released.html