CVE-2026-112991: MISP Modules html_to_markdown server-side request forgery

CVE-2026-112991 · Severity: info · Published 2026-10-19

MISP Modules is a platform for threat intelligence data processing and expansion. The html_to_markdown module, which converts HTML content to Markdown format, contains an incomplete URL validation that allows authenticated users to forge requests to internal network services. An attacker could abuse the MISP server as a proxy to read sensitive data from internal systems, carrier-grade NAT infrastructure, or link-local endpoints that are normally unreachable from outside the network.

Technologies: MISP Project Misp-Modules. Vendors: MISP Project.

Quick answers

Is CVE-2026-112991 exploited in the wild?
No. Junglewise Threat Intelligence has no report of CVE-2026-112991 being exploited in the wild.
How severe is CVE-2026-112991?
Informational severity, published 19 October 2026.
Which products and versions are affected?
MISP Project Misp-Modules <unknown.
Is there a fix for CVE-2026-112991?
No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.
How is CVE-2026-112991 attacked?
It is attacked over the network, in a software library.
Am I affected by CVE-2026-112991?
Check whether you run MISP Project Misp-Modules at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

The is_safe_url() validation function in the html_to_markdown expansion module fails to block several critical IP address ranges: 0.0.0.0/8, 100.64.0.0/10, ::/128, fc00::/7, and fe80::/10, as well as IPv4-mapped IPv6 addresses. An authenticated attacker with attribute modification permissions can supply URLs pointing to these ranges; the module fetches the URL server-side from the MISP server's network context, enabling read access to internal services. No code-execution or server compromise occurs, but the MISP instance is abused as an SSRF proxy.

Affected products

  • MISP Project MISP Modules <unknown

Timeline

  • 2026-10-19: disclosed

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.