An issue exists in MISP prior to 2.4.158. There is stored XSS in the event graph via a tag name.
misp misp