GitHub Advisoryadvisory · PyPI

GHSA-fhq3-2gf3-8f3j misp-modules has nsafe remote resource fetching in expansion

MEDIUM Published 2026-05-06 Modified 2026-05-14 Official page ↗
Aliases
CVE-2026-44363
Ecosystem
PyPI
Packages
misp-modules
Severity
Moderate
CVSS vector
CVSS:4.0/AV:A/AC:L/AT:P/PR:N/UI:N/VC:L/VI:N/VA:N/SC:H/SI:H/SA:H
Weaknesses
CWE-295, CWE-918
Reviewed
2026-05-06

Affected packages

• PyPI misp-modules: <= 3.0.7 (no fix yet)

Description

An unsafe remote resource fetching vulnerability existed in MISP Modules expansion modules. The html_to_markdown module accepted arbitrary HTTP(S) URLs without sufficient validation, which could allow Server-Side Request Forgery against loopback, private, or link-local network resources. Additionally, the qrcode module disabled TLS certificate verification when retrieving remote images, exposing requests to potential man-in-the-middle interception or response tampering. The issue was fixed by validating URL schemes, blocking local and private address ranges, resolving hostnames before fetching, enforcing request timeouts, and re-enabling TLS certificate verification. As reported by Bilal Teke.

Related

Alias · CVE (1)

  • CVE-2026-44363 MISP modules are autonomous modules that can be used to extend MISP for new services. vulnerability

Weakness · CWE (2)

  • CWE-295 Improper Certificate Validation weakness
  • CWE-918 Server-Side Request Forgery weakness

References