Is CVE-2026-62143 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-62143 being exploited in the wild.

How severe is CVE-2026-62143?

Informational severity, with a CVSS score of 8.3, published 13 July 2026.

Which products and versions are affected?

MISP Project Misp-Modules <= v3.0.8.

Is there a fix for CVE-2026-62143?

A patch was published on 2026-07-13: Fix committed to GitHub repository Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is CVE-2026-62143 attacked?

It is attacked over the network, in a software library.

Am I affected by CVE-2026-62143?

Check whether you run MISP Project Misp-Modules at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-62143: MISP misp-modules SSRF bypass in html_to_markdown module

Q: Is there a fix for CVE-2026-62143?

A patch was published on 2026-07-13: Fix committed to GitHub repository Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

Q: How is CVE-2026-62143 attacked?

It is attacked over the network, in a software library.

Q: Am I affected by CVE-2026-62143?

Check whether you run MISP Project Misp-Modules at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-62143 · Severity: info · CVSS 8.3 · Published 2026-07-13

A security vulnerability exists in a module used by the MISP threat intelligence platform to convert HTML content into Markdown format. An attacker could bypass security filters to force the server to connect to internal systems or cloud metadata services that are normally restricted. This could lead to the exposure of sensitive internal data, administrative interfaces, or configuration details from the server's local network.

Technologies: MISP Project Misp-Modules. Vendors: MISP Project.

Quick answers

Is CVE-2026-62143 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-62143 being exploited in the wild.
How severe is CVE-2026-62143?: Informational severity, with a CVSS score of 8.3, published 13 July 2026.
Which products and versions are affected?: MISP Project Misp-Modules <= v3.0.8.
Is there a fix for CVE-2026-62143?: A patch was published on 2026-07-13: Fix committed to GitHub repository Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-62143 attacked?: It is attacked over the network, in a software library.
Am I affected by CVE-2026-62143?: Check whether you run MISP Project Misp-Modules at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

A Server-Side Request Forgery (SSRF) vulnerability exists in the html_to_markdown expansion module of misp-modules due to improper validation of IPv4-mapped IPv6 addresses. While the module attempts to block requests to loopback, private, and link-local ranges, it fails to normalize IPv4-mapped IPv6 addresses (e.g., [::ffff:127.0.0.1]) before comparison. An authenticated attacker can bypass these filters to reach internal web services or cloud instance metadata (IMDS). The issue has been resolved by ensuring IP addresses are normalized to their underlying IPv4 representation before security checks are applied.

Affected products

MISP misp-modules <= v3.0.8

Timeline

2026-07-13: advisory: Published by CIRCL/NVD
2026-07-13: patched: Fix committed to GitHub repository

References

https://github.com/MISP/misp-modules/commit/3bae4108a3ba1e507727d5264697fd7303ba0b89

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.