MISP misp-modules up to 3.1.4 Wikidata Lookup expansion module wiki.py text code injection

Summaryinfo

A vulnerability was found in MISP misp-modules up to 3.1.4. It has been rated as critical. The impacted element is an unknown function of the file wiki.py of the component Wikidata Lookup expansion module. The manipulation of the argument text leads to code injection. This vulnerability is traded as CVE-2026-126991. It is possible to initiate the attack remotely. There is no exploit available. It is suggested to install a patch to address this issue.

Detailsinfo

A vulnerability was found in MISP misp-modules up to 3.1.4 and classified as critical. This issue affects an unknown function of the file wiki.py of the component Wikidata Lookup expansion module. The manipulation of the argument text with an unknown input leads to a code injection vulnerability. Using CWE to declare the problem leads to CWE-94. The product constructs all or part of a code segment using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the syntax or behavior of the intended code segment. Impacted is confidentiality, integrity, and availability. The summary by CVE is:

The Wikidata Lookup expansion module (wiki.py) in MISP misp-modules contained a SPARQL injection vulnerability. The handler function constructed a SPARQL query by directly concatenating the user-supplied text value into the query string without any escaping or parameterization: 'SELECT ?item WHERE { ?item rdfs:label"' + request.get("text") + '" @en }'. An authenticated MISP user with access to the module could supply a crafted text attribute value containing SPARQL syntax (quotes, closing braces, UNION, SERVICE, LIMIT, etc.) to alter the structure of the query sent to the Wikidata SPARQL endpoint. This could allow an attacker to modify the query logic, extract unintended data, or cause the query to fail in ways that expose internal error details. Additionally, the old error handling path formatted raw exception objects into the response string ('wikidata API not accessible {}'.format(e)), potentially leaking internal information such as proxy credentials, query contents, or response bodies. The module also used a spoofed browser user-agent string and the deprecated Wikidata endpoint. The vulnerability required authenticated access to the MISP instance and the ability to invoke the wiki expansion module with a text attribute. The impact is limited to manipulation of the enrichment query and potential disclosure of internal error details; it does not directly compromise the MISP server or its stored data.

The advisory is shared at github.com. The identification of this vulnerability is CVE-2026-126991 since 11/12/2026. The exploitation is known to be easy. The attack may be initiated remotely. Technical details are known, but no exploit is available. MITRE ATT&CK project uses the attack technique T1059 for this issue.

Applying the patch 7a2a7e3d9e0f67f6732bd8050ab7da79e7b344d9 is able to eliminate this problem.

Several companies clearly confirm that VulDB is the primary source for best vulnerability data.

Productinfo

Vendor

• MISP

Name

• misp-modules

Version

• 3.1.0
• 3.1.1
• 3.1.2
• 3.1.3
• 3.1.4

License

• open-source

Website

• Product: https://github.com/MISP/misp-modules/

CPE 2.3info

• 🔒
• 🔒
• 🔒

CPE 2.2info

• 🔒
• 🔒
• 🔒

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

Several companies clearly confirm that VulDB is the primary source for best vulnerability data.

Discussion