CVE-2026-112991 (GCVE-0-2026-112991)

Vulnerability from cvelistv5 – Published: 2026-10-19 22:19 – Updated: 2026-10-19 22:19
VLAI
Title
MISP html_to_markdown Module SSRF via Incomplete IP Range Blocking in is_safe_url()
Summary
The html_to_markdown expansion module in MISP Modules contains a server-side request forgery (SSRF) vulnerability in its is_safe_url() URL validation function. The BLOCKED_RANGES list used to reject unsafe destination addresses was incomplete, omitting several critical IP address ranges. Specifically, the following ranges were not blocked: 0.0.0.0/8 (unspecified, which routes to loopback on Linux), 100.64.0.0/10 (carrier-grade NAT per RFC 6598), ::/128 (IPv6 unspecified), fc00::/7 (IPv6 Unique Local Addresses), and fe80::/10 (IPv6 link-local). The existing list only covered IPv4 loopback (127.0.0.0/8), RFC 1918 private ranges, IPv4 link-local (169.254.0.0/16), and IPv6 loopback (::1/128). An authenticated user with the ability to create or modify MISP attributes that trigger the html_to_markdown expansion module could supply URLs pointing to these unblocked internal address ranges. Because the module fetches the URL server-side to convert HTML content to Markdown, the request is made from the MISP server's network context. This allows an attacker to probe and read responses from internal services, carrier-grade NAT infrastructure, or link-local endpoints that would otherwise be unreachable from external networks. IPv4-mapped IPv6 forms (e.g., [::ffff:0.0.0.0]) also bypassed the existing checks. The security impact is primarily confidentiality: an attacker can read data served by internal services reachable from the MISP server. The MISP instance itself is not compromised, but it is abused as a proxy to access otherwise restricted network resources.
Severity
6.3 (Medium)
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:N/SC:H/SI:N/SA:N
SSVC
Exploitation: none Automatable: yes Technical Impact: partial
Supplier · CIRCL (v2.0.3)
Decision recorded 2026-10-19 22:15 UTC
CWE
  • CWE-918 - Server-Side Request Forgery (SSRF)
  • CWE-20 - Improper Input Validation
Assigner
CIRCL CNA under the ENISA root
CNA scorecard A 90/100 over 244 records in the last 180 days details
References
Impacted products
Vendor Product Version CPE status
MISP MISP Modules Affected: 0 , ≤ 3.0.12 (semver)
    cpe:2.3:a:misp:misp_modules_\(html_to_markdown_expansion_module\):*:*:*:*:*:*:*:*
Create a notification for this product.
Credits
elhoim Claude Opus 5 (1M context)
GCVE extensions
bcp-05-x-01
AI-assisted vulnerability information annotation
GCVE-BCP-05-X-01
Whole record AI-generated Partially reviewed GNA-1

Draft vulnerability metadata was generated from a git-format patch using an Ollama-hosted language model. Human validation is required before publication.

ai-computer-assisted:llm-generatedai-computer-assisted:classification
Model Source Identifier
qwen3.8:27b ollama qwen3.8:27b
bcp-05-x-02
Patch-to-vulnerability generation provenance
GCVE-BCP-05-X-02
Generator
patch2vuln.py on 2026-10-19 22:15
Model
qwen3.8:27b
Input
https://github.com/misp/misp-modules/commit/98a1c2c2f297665dd8d4609e9cd644007a57516b.patch a1b0755b91dd…
Confidence
medium
Commit Subject Patch SHA-256
98a1c2c2f297 fix: [html_to_markdown] block unspecified, shared, ULA and a1b0755b91dd…
Fix summary

The fix extends the BLOCKED_RANGES list in is_safe_url() to include the previously missing IP address ranges: 0.0.0.0/8, 100.64.0.0/10, ::/128, fc00::/7, and fe80::/10. The existing IPv4-mapped IPv6 normalisation logic ensures that mapped forms (e.g., ::ffff:0.0.0.0) are also blocked. Regression tests are added covering both literal IP addresses in URLs and hostnames that resolve to the newly blocked ranges.

Patch summary

In misp_modules/modules/expansion/html_to_markdown.py, five new ipaddress.ip_network() entries are added to the BLOCKED_RANGES list: 0.0.0.0/8, 100.64.0.0/10, ::/128, fc00::/7, and fe80::/10. In tests/test_html_to_markdown.py, two new test methods are added: test_blocks_unspecified_shared_ula_and_link_local_literals verifies that is_safe_url() returns False for literal URLs using each blocked range (including IPv4-mapped IPv6 forms), and test_blocks_hostnames_resolving_to_ula_addresses verifies that a hostname resolving to an fc00::/7 address is rejected.

CVSS rationale

AV:N: The vulnerable URL is supplied via a MISP attribute over the network. AC:L: Crafting a URL with a blocked-range IP is straightforward; no race or special timing is needed. AT:N: No manipulation of the target service is required. PR:L: Creating or modifying a MISP attribute that triggers the expansion module requires authenticated access (assumed; MISP typically requires authentication for attribute operations). UI:N: No victim interaction beyond the initial attribute creation is needed. VC:N, VI:N, VA:N: The MISP server itself is not compromised; it is used as a proxy. SC:H: The SSRF allows reading responses from internal services (e.g., cloud metadata endpoints, internal admin panels), representing a high confidentiality impact on the target system. SI:N, SA:N: The module performs a GET-style fetch for HTML-to-Markdown conversion; no evidence of write or security-impact on the target.

Weakness rationale
  • CWE-918 The html_to_markdown module fetches a user-supplied URL server-side. The incomplete IP range allow/block list permitted requests to internal, link-local, and otherwise restricted network destinations, constituting a classic SSRF.
  • CWE-20 The is_safe_url() function's BLOCKED_RANGES list was incomplete, failing to validate against all non-routable and internally significant IP address ranges. This is the root-cause input validation deficiency enabling the SSRF.
Attack pattern rationale
  • CAPEC-12 The patch directly addresses an SSRF condition: the application fetches a URL on behalf of the user, and the validation logic failed to block requests to internal and restricted IP ranges. An attacker crafts a URL with a blocked-range IP (e.g., http://0.0.0.0/admin or http://[fe80::1]/) to cause the MISP server to issue a request to an internal service. This is the canonical CAPEC-12 pattern. No uncertainty in this mapping.
Assumptions to verify
  • PR:L assumes that creating or modifying a MISP attribute to trigger the html_to_markdown expansion module requires authenticated access. MISP typically enforces authentication for attribute operations, but the patch does not explicitly state the authentication model.
  • SC:H assumes the MISP server can reach internal services (e.g., cloud metadata at 169.254.169.254, internal admin panels, or CGNAT infrastructure) and that the responses are returned to the attacker via the Markdown conversion output. The actual impact depends on the server's network topology.
  • The exact affected version range is not specified in the patch. The nearest tag is v3.0.13 with 139 commits after the fix, but the precise release containing the fix is not identified.
  • CAPEC-12 is selected as the closest match; no alternative CAPEC more precisely describes an SSRF via incomplete IP-range validation in a URL-fetching module.
  • The patch does not indicate whether the module follows redirects to additional unblocked ranges; MAX_REDIRECTS is set to 10, and the redirect target validation is not shown in this patch. If redirect targets are not re-validated, the SSRF surface may be broader than what this patch addresses.
Model comparison

Selected qwen3.8:27b by deterministic-consensus-v1
The selected result is closest to model consensus; this heuristic does not establish factual correctness and human review remains required.

Model Score Agreement Confidence Assumptions
qwen3.8:27b 7 11 medium 5
bcp-05-x-03
Vulnerability handling and disclosure timeline
GCVE-BCP-05-X-03
  1. 2026-09-25 22:15 UTC Fix developed Corrective change authored (98a1c2c2f297665dd8d4609e9cd644007a57516b): fix: [html_to_markdown] block unspecified, shared, ULA and
Show details on NVD website
To clipboard 

{
  "containers": {
    "cna": {
      "affected": [
        {
          "cpes": [
            "cpe:2.3:a:misp:misp_modules_\\(html_to_markdown_expansion_module\\):*:*:*:*:*:*:*:*"
          ],
          "modules": [
            "misp_modules/modules/expansion/html_to_markdown.py"
          ],
          "product": "MISP Modules",
          "programFiles": [
            "misp_modules/modules/expansion/html_to_markdown.py"
          ],
          "repo": "https://github.com/misp/misp-modules",
          "vendor": "MISP",
          "versions": [
            {
              "lessThanOrEqual": "3.0.12",
              "status": "affected",
              "version": "0",
              "versionType": "semver"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "remediation developer",
          "value": "elhoim"
        },
        {
          "lang": "en",
          "type": "remediation developer",
          "value": "Claude Opus 5 (1M context)"
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "supportingMedia": [
            {
              "base64": false,
              "type": "text/html",
              "value": "\u003cp\u003eThe html_to_markdown expansion module in MISP Modules contains a server-side request forgery (SSRF) vulnerability in its is_safe_url() URL validation function. The BLOCKED_RANGES list used to reject unsafe destination addresses was incomplete, omitting several critical IP address ranges. Specifically, the following ranges were not blocked: 0.0.0.0/8 (unspecified, which routes to loopback on Linux), 100.64.0.0/10 (carrier-grade NAT per RFC 6598), ::/128 (IPv6 unspecified), fc00::/7 (IPv6 Unique Local Addresses), and fe80::/10 (IPv6 link-local). The existing list only covered IPv4 loopback (127.0.0.0/8), RFC 1918 private ranges, IPv4 link-local (169.254.0.0/16), and IPv6 loopback (::1/128).\u003c/p\u003e\u003cp\u003eAn authenticated user with the ability to create or modify MISP attributes that trigger the html_to_markdown expansion module could supply URLs pointing to these unblocked internal address ranges. Because the module fetches the URL server-side to convert HTML content to Markdown, the request is made from the MISP server\u0027s network context. This allows an attacker to probe and read responses from internal services, carrier-grade NAT infrastructure, or link-local endpoints that would otherwise be unreachable from external networks. IPv4-mapped IPv6 forms (e.g., [::ffff:0.0.0.0]) also bypassed the existing checks.\u003c/p\u003e\u003cp\u003eThe security impact is primarily confidentiality: an attacker can read data served by internal services reachable from the MISP server. The MISP instance itself is not compromised, but it is abused as a proxy to access otherwise restricted network resources.\u003c/p\u003e"
            }
          ],
          "value": "The html_to_markdown expansion module in MISP Modules contains a server-side request forgery (SSRF) vulnerability in its is_safe_url() URL validation function. The BLOCKED_RANGES list used to reject unsafe destination addresses was incomplete, omitting several critical IP address ranges. Specifically, the following ranges were not blocked: 0.0.0.0/8 (unspecified, which routes to loopback on Linux), 100.64.0.0/10 (carrier-grade NAT per RFC 6598), ::/128 (IPv6 unspecified), fc00::/7 (IPv6 Unique Local Addresses), and fe80::/10 (IPv6 link-local). The existing list only covered IPv4 loopback (127.0.0.0/8), RFC 1918 private ranges, IPv4 link-local (169.254.0.0/16), and IPv6 loopback (::1/128).\n\nAn authenticated user with the ability to create or modify MISP attributes that trigger the html_to_markdown expansion module could supply URLs pointing to these unblocked internal address ranges. Because the module fetches the URL server-side to convert HTML content to Markdown, the request is made from the MISP server\u0027s network context. This allows an attacker to probe and read responses from internal services, carrier-grade NAT infrastructure, or link-local endpoints that would otherwise be unreachable from external networks. IPv4-mapped IPv6 forms (e.g., [::ffff:0.0.0.0]) also bypassed the existing checks.\n\nThe security impact is primarily confidentiality: an attacker can read data served by internal services reachable from the MISP server. The MISP instance itself is not compromised, but it is abused as a proxy to access otherwise restricted network resources."
        }
      ],
      "impacts": [
        {
          "capecId": "CAPEC-12",
          "descriptions": [
            {
              "lang": "en",
              "value": "CAPEC-12 Server Side Request Forgery"
            }
          ]
        }
      ],
      "metrics": [
        {
          "cvssV4_0": {
            "Automatable": "NOT_DEFINED",
            "Recovery": "NOT_DEFINED",
            "Safety": "NOT_DEFINED",
            "attackComplexity": "LOW",
            "attackRequirements": "NONE",
            "attackVector": "NETWORK",
            "baseScore": 6.3,
            "baseSeverity": "MEDIUM",
            "privilegesRequired": "LOW",
            "providerUrgency": "NOT_DEFINED",
            "subAvailabilityImpact": "NONE",
            "subConfidentialityImpact": "HIGH",
            "subIntegrityImpact": "NONE",
            "userInteraction": "NONE",
            "valueDensity": "NOT_DEFINED",
            "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:N/SC:H/SI:N/SA:N",
            "version": "4.0",
            "vulnAvailabilityImpact": "NONE",
            "vulnConfidentialityImpact": "NONE",
            "vulnIntegrityImpact": "NONE",
            "vulnerabilityResponseEffort": "NOT_DEFINED"
          },
          "format": "CVSS",
          "scenarios": [
            {
              "lang": "en",
              "value": "GENERAL"
            }
          ]
        },
        {
          "format": "SSVC",
          "other": {
            "content": {
              "options": [
                {
                  "Exploitation": "none"
                },
                {
                  "Automatable": "yes"
                },
                {
                  "Technical Impact": "partial"
                }
              ],
              "role": "Supplier",
              "timestamp": "2026-10-19T22:15:01Z",
              "version": "2.0.3"
            },
            "type": "SSVC"
          },
          "scenarios": [
            {
              "lang": "en",
              "value": "GENERAL"
            }
          ]
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-918",
              "description": "CWE-918 Server-Side Request Forgery (SSRF)",
              "lang": "en",
              "type": "CWE"
            }
          ]
        },
        {
          "descriptions": [
            {
              "cweId": "CWE-20",
              "description": "CWE-20 Improper Input Validation",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-10-19T22:19:50.011Z",
        "orgId": "5a6e4751-2f3f-4070-9419-94fb35b644e8",
        "shortName": "CIRCL"
      },
      "references": [
        {
          "name": "Security patch",
          "tags": [
            "patch"
          ],
          "url": "https://github.com/misp/misp-modules/commit/98a1c2c2f297665dd8d4609e9cd644007a57516b"
        }
      ],
      "solutions": [
        {
          "lang": "en",
          "supportingMedia": [
            {
              "base64": false,
              "type": "text/html",
              "value": "\u003cp\u003eThe fix extends the BLOCKED_RANGES list in is_safe_url() to include the previously missing IP address ranges: 0.0.0.0/8, 100.64.0.0/10, ::/128, fc00::/7, and fe80::/10. The existing IPv4-mapped IPv6 normalisation logic ensures that mapped forms (e.g., ::ffff:0.0.0.0) are also blocked. Regression tests are added covering both literal IP addresses in URLs and hostnames that resolve to the newly blocked ranges.\u003c/p\u003e"
            }
          ],
          "value": "The fix extends the BLOCKED_RANGES list in is_safe_url() to include the previously missing IP address ranges: 0.0.0.0/8, 100.64.0.0/10, ::/128, fc00::/7, and fe80::/10. The existing IPv4-mapped IPv6 normalisation logic ensures that mapped forms (e.g., ::ffff:0.0.0.0) are also blocked. Regression tests are added covering both literal IP addresses in URLs and hostnames that resolve to the newly blocked ranges."
        }
      ],
      "title": "MISP html_to_markdown Module SSRF via Incomplete IP Range Blocking in is_safe_url()",
      "x_gcve": [
        {
          "extensions": {
            "bcp-05-x-01": {
              "ai_annotations": [
                {
                  "ai_level": "generated",
                  "description": "Draft vulnerability metadata was generated from a git-format patch using an Ollama-hosted language model. Human validation is required before publication.",
                  "gna_source": 1,
                  "models": [
                    {
                      "gna_source": 1,
                      "identifier": "qwen3.8:27b",
                      "name": "qwen3.8:27b",
                      "source": "ollama"
                    }
                  ],
                  "review_status": "partial",
                  "scope": "record",
                  "tags": [
                    "ai-computer-assisted:llm-generated",
                    "ai-computer-assisted:classification"
                  ]
                }
              ]
            },
            "bcp-05-x-02": {
              "x_patch2vuln": {
                "assumptions": [
                  "PR:L assumes that creating or modifying a MISP attribute to trigger the html_to_markdown expansion module requires authenticated access. MISP typically enforces authentication for attribute operations, but the patch does not explicitly state the authentication model.",
                  "SC:H assumes the MISP server can reach internal services (e.g., cloud metadata at 169.254.169.254, internal admin panels, or CGNAT infrastructure) and that the responses are returned to the attacker via the Markdown conversion output. The actual impact depends on the server\u0027s network topology.",
                  "The exact affected version range is not specified in the patch. The nearest tag is v3.0.13 with 139 commits after the fix, but the precise release containing the fix is not identified.",
                  "CAPEC-12 is selected as the closest match; no alternative CAPEC more precisely describes an SSRF via incomplete IP-range validation in a URL-fetching module.",
                  "The patch does not indicate whether the module follows redirects to additional unblocked ranges; MAX_REDIRECTS is set to 10, and the redirect target validation is not shown in this patch. If redirect targets are not re-validated, the SSRF surface may be broader than what this patch addresses."
                ],
                "capecRationale": [
                  {
                    "capecId": "CAPEC-12",
                    "rationale": "The patch directly addresses an SSRF condition: the application fetches a URL on behalf of the user, and the validation logic failed to block requests to internal and restricted IP ranges. An attacker crafts a URL with a blocked-range IP (e.g., http://0.0.0.0/admin or http://[fe80::1]/) to cause the MISP server to issue a request to an internal service. This is the canonical CAPEC-12 pattern. No uncertainty in this mapping."
                  }
                ],
                "commit": "98a1c2c2f297665dd8d4609e9cd644007a57516b",
                "confidence": "medium",
                "credits": [
                  {
                    "lang": "en",
                    "type": "remediation developer",
                    "value": "elhoim"
                  },
                  {
                    "lang": "en",
                    "type": "remediation developer",
                    "value": "Claude Opus 5 (1M context)"
                  }
                ],
                "cvssRationale": "AV:N: The vulnerable URL is supplied via a MISP attribute over the network. AC:L: Crafting a URL with a blocked-range IP is straightforward; no race or special timing is needed. AT:N: No manipulation of the target service is required. PR:L: Creating or modifying a MISP attribute that triggers the expansion module requires authenticated access (assumed; MISP typically requires authentication for attribute operations). UI:N: No victim interaction beyond the initial attribute creation is needed. VC:N, VI:N, VA:N: The MISP server itself is not compromised; it is used as a proxy. SC:H: The SSRF allows reading responses from internal services (e.g., cloud metadata endpoints, internal admin panels), representing a high confidentiality impact on the target system. SI:N, SA:N: The module performs a GET-style fetch for HTML-to-Markdown conversion; no evidence of write or security-impact on the target.",
                "fixSummary": "The fix extends the BLOCKED_RANGES list in is_safe_url() to include the previously missing IP address ranges: 0.0.0.0/8, 100.64.0.0/10, ::/128, fc00::/7, and fe80::/10. The existing IPv4-mapped IPv6 normalisation logic ensures that mapped forms (e.g., ::ffff:0.0.0.0) are also blocked. Regression tests are added covering both literal IP addresses in URLs and hostnames that resolve to the newly blocked ranges.",
                "generatedAt": "2026-10-19T22:15:01.979194Z",
                "generator": "patch2vuln.py",
                "model": "qwen3.8:27b",
                "modelComparison": {
                  "rankings": [
                    {
                      "agreementScore": 11,
                      "assumptionCount": 5,
                      "confidence": "medium",
                      "model": "qwen3.8:27b",
                      "score": 7
                    }
                  ],
                  "selectedModel": "qwen3.8:27b",
                  "selectionMethod": "deterministic-consensus-v1",
                  "selectionNotice": "The selected result is closest to model consensus; this heuristic does not establish factual correctness and human review remains required."
                },
                "patchSha256": "a1b0755b91ddfee8869bba03e3d5eb00ffedd8e753d6d03e40c059d056567b28",
                "patchSummary": "In misp_modules/modules/expansion/html_to_markdown.py, five new ipaddress.ip_network() entries are added to the BLOCKED_RANGES list: 0.0.0.0/8, 100.64.0.0/10, ::/128, fc00::/7, and fe80::/10. In tests/test_html_to_markdown.py, two new test methods are added: test_blocks_unspecified_shared_ula_and_link_local_literals verifies that is_safe_url() returns False for literal URLs using each blocked range (including IPv4-mapped IPv6 forms), and test_blocks_hostnames_resolving_to_ula_addresses verifies that a hostname resolving to an fc00::/7 address is rejected.",
                "patchTruncated": false,
                "patches": [
                  {
                    "commit": "98a1c2c2f297665dd8d4609e9cd644007a57516b",
                    "date": "Fri, 25 Sep 2026 22:15:46 +0000",
                    "patchSha256": "a1b0755b91ddfee8869bba03e3d5eb00ffedd8e753d6d03e40c059d056567b28",
                    "source": "https://github.com/misp/misp-modules/commit/98a1c2c2f297665dd8d4609e9cd644007a57516b.patch",
                    "sourceUrl": "https://github.com/misp/misp-modules/commit/98a1c2c2f297665dd8d4609e9cd644007a57516b.patch",
                    "subject": "fix: [html_to_markdown] block unspecified, shared, ULA and"
                  }
                ],
                "source": "https://github.com/misp/misp-modules/commit/98a1c2c2f297665dd8d4609e9cd644007a57516b.patch",
                "ssvc": {
                  "options": [
                    {
                      "Exploitation": "none"
                    },
                    {
                      "Automatable": "yes"
                    },
                    {
                      "Technical Impact": "partial"
                    }
                  ],
                  "role": "Supplier",
                  "timestamp": "2026-10-19T22:15:01Z",
                  "version": "2.0.3"
                },
                "subject": "fix: [html_to_markdown] block unspecified, shared, ULA and",
                "tagVersionBoundary": {
                  "commits_after_fix": 139,
                  "repository": "https://github.com/misp/misp-modules",
                  "tag": "v3.0.13",
                  "version": "3.0.13",
                  "version_type": "semver"
                },
                "weaknessRationale": [
                  {
                    "cweId": "CWE-918",
                    "rationale": "The html_to_markdown module fetches a user-supplied URL server-side. The incomplete IP range allow/block list permitted requests to internal, link-local, and otherwise restricted network destinations, constituting a classic SSRF."
                  },
                  {
                    "cweId": "CWE-20",
                    "rationale": "The is_safe_url() function\u0027s BLOCKED_RANGES list was incomplete, failing to validate against all non-routable and internally significant IP address ranges. This is the root-cause input validation deficiency enabling the SSRF."
                  }
                ]
              }
            },
            "bcp-05-x-03": {
              "x_timeline": {
                "events": [
                  {
                    "description": "Corrective change authored (98a1c2c2f297665dd8d4609e9cd644007a57516b): fix: [html_to_markdown] block unspecified, shared, ULA and",
                    "id": "evt-fix-developed-1",
                    "references": [
                      "https://github.com/misp/misp-modules/commit/98a1c2c2f297665dd8d4609e9cd644007a57516b.patch"
                    ],
                    "timestamp": "2026-09-25T22:15:46Z",
                    "type": "fix-developed"
                  }
                ]
              }
            }
          },
          "recordType": "advisory",
          "vulnId": "GCVE-1-2026-20287"
        }
      ]
    }
  },
  "cveMetadata": {
    "assignerOrgId": "5a6e4751-2f3f-4070-9419-94fb35b644e8",
    "assignerShortName": "CIRCL",
    "cveId": "CVE-2026-112991",
    "datePublished": "2026-10-19T22:19:50.011Z",
    "dateReserved": "2026-10-19T22:19:44.187Z",
    "dateUpdated": "2026-10-19T22:19:50.011Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2",
  "vulnerability-lookup:meta": {
    "nvd": {
      "cve": {
        "affected": [
          {
            "affectedData": [
              {
                "cpes": [
                  "cpe:2.3:a:misp:misp_modules_\\(html_to_markdown_expansion_module\\):*:*:*:*:*:*:*:*"
                ],
                "modules": [
                  "misp_modules/modules/expansion/html_to_markdown.py"
                ],
                "product": "MISP Modules",
                "programFiles": [
                  "misp_modules/modules/expansion/html_to_markdown.py"
                ],
                "repo": "https://github.com/misp/misp-modules",
                "vendor": "MISP",
                "versions": [
                  {
                    "lessThanOrEqual": "3.0.12",
                    "status": "affected",
                    "version": "0",
                    "versionType": "semver"
                  }
                ]
              }
            ],
            "source": "5a6e4751-2f3f-4070-9419-94fb35b644e8"
          }
        ],
        "cveTags": [],
        "descriptions": [
          {
            "lang": "en",
            "value": "The html_to_markdown expansion module in MISP Modules contains a server-side request forgery (SSRF) vulnerability in its is_safe_url() URL validation function. The BLOCKED_RANGES list used to reject unsafe destination addresses was incomplete, omitting several critical IP address ranges. Specifically, the following ranges were not blocked: 0.0.0.0/8 (unspecified, which routes to loopback on Linux), 100.64.0.0/10 (carrier-grade NAT per RFC 6598), ::/128 (IPv6 unspecified), fc00::/7 (IPv6 Unique Local Addresses), and fe80::/10 (IPv6 link-local). The existing list only covered IPv4 loopback (127.0.0.0/8), RFC 1918 private ranges, IPv4 link-local (169.254.0.0/16), and IPv6 loopback (::1/128).\n\nAn authenticated user with the ability to create or modify MISP attributes that trigger the html_to_markdown expansion module could supply URLs pointing to these unblocked internal address ranges. Because the module fetches the URL server-side to convert HTML content to Markdown, the request is made from the MISP server\u0027s network context. This allows an attacker to probe and read responses from internal services, carrier-grade NAT infrastructure, or link-local endpoints that would otherwise be unreachable from external networks. IPv4-mapped IPv6 forms (e.g., [::ffff:0.0.0.0]) also bypassed the existing checks.\n\nThe security impact is primarily confidentiality: an attacker can read data served by internal services reachable from the MISP server. The MISP instance itself is not compromised, but it is abused as a proxy to access otherwise restricted network resources."
          }
        ],
        "id": "CVE-2026-112991",
        "lastModified": "2026-10-19T23:17:36.350",
        "metrics": {
          "cvssMetricV40": [
            {
              "cvssData": {
                "Automatable": "NOT_DEFINED",
                "Recovery": "NOT_DEFINED",
                "Safety": "NOT_DEFINED",
                "attackComplexity": "LOW",
                "attackRequirements": "NONE",
                "attackVector": "NETWORK",
                "availabilityRequirement": "NOT_DEFINED",
                "baseScore": 6.3,
                "baseSeverity": "MEDIUM",
                "confidentialityRequirement": "NOT_DEFINED",
                "exploitMaturity": "NOT_DEFINED",
                "integrityRequirement": "NOT_DEFINED",
                "modifiedAttackComplexity": "NOT_DEFINED",
                "modifiedAttackRequirements": "NOT_DEFINED",
                "modifiedAttackVector": "NOT_DEFINED",
                "modifiedPrivilegesRequired": "NOT_DEFINED",
                "modifiedSubAvailabilityImpact": "NOT_DEFINED",
                "modifiedSubConfidentialityImpact": "NOT_DEFINED",
                "modifiedSubIntegrityImpact": "NOT_DEFINED",
                "modifiedUserInteraction": "NOT_DEFINED",
                "modifiedVulnAvailabilityImpact": "NOT_DEFINED",
                "modifiedVulnConfidentialityImpact": "NOT_DEFINED",
                "modifiedVulnIntegrityImpact": "NOT_DEFINED",
                "privilegesRequired": "LOW",
                "providerUrgency": "NOT_DEFINED",
                "subAvailabilityImpact": "NONE",
                "subConfidentialityImpact": "HIGH",
                "subIntegrityImpact": "NONE",
                "userInteraction": "NONE",
                "valueDensity": "NOT_DEFINED",
                "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:N/SC:H/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X",
                "version": "4.0",
                "vulnAvailabilityImpact": "NONE",
                "vulnConfidentialityImpact": "NONE",
                "vulnIntegrityImpact": "NONE",
                "vulnerabilityResponseEffort": "NOT_DEFINED"
              },
              "source": "5a6e4751-2f3f-4070-9419-94fb35b644e8",
              "type": "Secondary"
            }
          ],
          "ssvcV203": [
            {
              "source": "5a6e4751-2f3f-4070-9419-94fb35b644e8",
              "ssvcData": {
                "options": [
                  {
                    "exploitation": "none"
                  },
                  {
                    "automatable": "yes"
                  },
                  {
                    "technicalImpact": "partial"
                  }
                ],
                "role": "Supplier",
                "timestamp": "2026-10-19T22:15:01Z",
                "version": "2.0.3"
              }
            }
          ]
        },
        "published": "2026-10-19T23:17:36.350",
        "references": [
          {
            "source": "5a6e4751-2f3f-4070-9419-94fb35b644e8",
            "url": "https://github.com/misp/misp-modules/commit/98a1c2c2f297665dd8d4609e9cd644007a57516b"
          }
        ],
        "sourceIdentifier": "5a6e4751-2f3f-4070-9419-94fb35b644e8",
        "vulnStatus": "Received",
        "weaknesses": [
          {
            "description": [
              {
                "lang": "en",
                "value": "CWE-20"
              },
              {
                "lang": "en",
                "value": "CWE-918"
              }
            ],
            "source": "5a6e4751-2f3f-4070-9419-94fb35b644e8",
            "type": "Secondary"
          }
        ]
      }
    }
  }
}



Log in or create an account to share your comment.




Tags
Taxonomy of the tags.




Drag nodes to arrange them. Double-click a related vulnerability to open it, or a source to visit its link. The Physics button on the left tunes the layout and the simulation; the legend at the bottom left hides or shows nodes by kind and by sighting type.

Forecast uses a logistic model when the trend is rising, or an exponential decay model when the trend is falling. Fitted via linearized least squares.

Sightings

Author Source Type Date Other

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or observed by the user.
  • Confirmed: The vulnerability has been validated from an analyst's perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
  • Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
  • Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
  • Not confirmed: The user expressed doubt about the validity of the vulnerability.
  • Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.
Vulnerability timeline

Sightings and recorded dates, grouped by day · UTC

JSON

Loading timeline…




    Related by attack behaviour

    Vulnerabilities whose description is nearest to this one in the vector space of the CIRCL/vulnerability-attack-technique-biencoder model. This is a similarity search over the bi-encoder space (plain cosine), not a classification, and it has no measured accuracy.