Unsafe remote resource fetching in expansion misp-modules
Key facts
- Attack vector
- Adjacent network
- Privileges required
- None
- User interaction
- None
- Attack complexity
- Low
- Attack requirements
- Present
- Impact type
- Spoofing, Information disclosure
- Confidentiality · integrity · availability
- Low · None · None
- Fix status
- Fixed
Attack profile from CVSS 4.0 · CNA. Fix status from CNA and GitHub. Impact type from CWE-295, CWE-918 and the CVSS impact.
Summary
MISP modules are autonomous modules that can be used to extend MISP for new services. Prior to 3.0.7, an unsafe remote resource fetching vulnerability existed in MISP Modules expansion modules. The html_to_markdown module accepted arbitrary HTTP(S) URLs without sufficient validation, which could allow Server-Side Request Forgery against loopback, private, or link-local network resources. Additionally, the qrcode module disabled TLS certificate verification when retrieving remote images, exposing requests to potential man-in-the-middle interception or response tampering. The issue was fixed by validating URL schemes, blocking local and private address ranges, resolving hostnames before fetching, enforcing request timeouts, and re-enabling TLS certificate verification. This vulnerability is fixed in 3.0.7.
Why it matters now
SSVC decision points
CISA ADP · SSVC 2.0.3
- Exploitation
- None
- Automatable
- No
- Technical impact
- Partial
The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| MISP | misp-modules | before 3.0.7 | 3.0.7 | Patch available | CNA |
| — | misp-modules (PyPI) | before 3.0.8 | 3.0.8 | Patch available | GHSA-fhq3-2gf3-8f3j |
- misp-modules VendorMISP Affected before 3.0.7 Fixed in 3.0.7 Patch available CNA
- misp-modules (PyPI) Vendor— Affected before 3.0.8 Fixed in 3.0.8 Patch available GHSA-fhq3-2gf3-8f3j
Remediation
- Fix · CNA misp-modules (MISP) Fixed in 3.0.7
- Fix · GHSA-fhq3-2gf3-8f3j misp-modules (PyPI) Fixed in 3.0.8 Advisory →
Timeline
- 2026-10-02 Threatist record created from CVE-2026-44363
- 2026-10-03 Alias added: GHSA-fhq3-2gf3-8f3j
- 2026-11-07 Fix available: PyPI/[email protected] · GHSA-fhq3-2gf3-8f3j
- 2026-11-07 4 new references · GHSA-fhq3-2gf3-8f3j
References
Advisory 2
Other 6
- https://github.com/MISP/misp-modules/security/advisories/GHSA-fhq3-2gf3-8f3j
- https://github.com/MISP/misp-modules/commit/01a522f2772fc31eeed379ccf23750c8a3d401db
- https://github.com/MISP/misp-modules/commit/52cda9caa003cafe87e14ae3721db5e16f6f111a
- https://github.com/MISP/misp-modules
- https://github.com/pypa/advisory-database/tree/main/vulns/misp-modules/PYSEC-2026-2650.yaml
- https://pypi.org/project/misp-modules
More MISP vulnerabilities
- TI-2025-41517 In MISP before 2.5.28, app/View/Elements/Workflows/executionPath.ctp allows XSS in the workflow execution path. CVSS 3.1CRITICAL 9.0
- TI-2026-65744 MISP TOTP Code Replay Allows Duplicate Authentication Within Validity Period CVSS 4.0CRITICAL 9.3
- TI-2026-54145 Path Traversal in MISP Object Template Resolution During STIX Import and Export in misp-stix library CVSS 4.0HIGH 8.8
- TI-2020-10250 MISP MISP-maltego 1.4.4 incorrectly shares a MISP connection across users in a remote-transform use case. CVSS 3.1CRITICAL 9.8
- TI-2026-59159 MISP Unauthenticated Mail Endpoints Allow Unbounded Storage Consumption and Request Flooding CVSS 4.0HIGH 8.7
- TI-2026-58541 MISP LDAP and LinOTP Authentication Bypass via Empty or Invalid Credentials CVSS 4.0CRITICAL 9.5
Sources
- CVE-2026-44363 · CVE Program
- CVE-2026-44363 · NVD
- FIRST EPSS
- GHSA-fhq3-2gf3-8f3j · GitHub Advisory Database · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences