Executive brief
A security vulnerability exists in a module used by the MISP threat intelligence platform to convert HTML content into Markdown format. An attacker could bypass security filters to force the server to connect to internal systems or cloud metadata services that are normally restricted. This could lead to the exposure of sensitive internal data, administrative interfaces, or configuration details from the server's local network.
Technical details
A Server-Side Request Forgery (SSRF) vulnerability exists in the html_to_markdown expansion module of misp-modules due to improper validation of IPv4-mapped IPv6 addresses. While the module attempts to block requests to loopback, private, and link-local ranges, it fails to normalize IPv4-mapped IPv6 addresses (e.g., [::ffff:127.0.0.1]) before comparison. An authenticated attacker can bypass these filters to reach internal web services or cloud instance metadata (IMDS). The issue has been resolved by ensuring IP addresses are normalized to their underlying IPv4 representation before security checks are applied.
Affected products
- MISP misp-modules <= v3.0.8
Timeline
- 2026-07-13: advisory: Published by CIRCL/NVD
- 2026-07-13: patched: Fix committed to GitHub repository