id: PYSEC-2026-2650
published: "2026-07-13T15:15:40.156015Z"
modified: "2026-07-13T16:04:52.190706Z"
aliases:
- CVE-2026-44363
- GHSA-fhq3-2gf3-8f3j
summary: misp-modules has nsafe remote resource fetching in expansion
details: An unsafe remote resource fetching vulnerability existed in MISP Modules expansion modules. The html_to_markdown module accepted arbitrary HTTP(S) URLs without sufficient validation, which could allow Server-Side Request Forgery against loopback, private, or link-local network resources. Additionally, the qrcode module disabled TLS certificate verification when retrieving remote images, exposing requests to potential man-in-the-middle interception or response tampering. The issue was fixed by validating URL schemes, blocking local and private address ranges, resolving hostnames before fetching, enforcing request timeouts, and re-enabling TLS certificate verification. As reported by Bilal Teke.
affected:
- package:
    name: misp-modules
    ecosystem: PyPI
    purl: pkg:pypi/misp-modules
  ranges:
  - type: ECOSYSTEM
    events:
    - introduced: "0"
    - last_affected: 3.0.7
  versions:
  - 2.4.196
  - 2.4.197
  - 2.4.198
  - 2.4.199
  - 2.4.200
  - 2.4.201
  - 3.0.0
  - 3.0.1
  - 3.0.2
  - 3.0.4
  - 3.0.5
  - 3.0.6
  - 3.0.7
references:
- type: WEB
  url: https://github.com/MISP/misp-modules/security/advisories/GHSA-fhq3-2gf3-8f3j
- type: ADVISORY
  url: https://nvd.nist.gov/vuln/detail/CVE-2026-44363
- type: WEB
  url: https://github.com/MISP/misp-modules/commit/01a522f2772fc31eeed379ccf23750c8a3d401db
- type: PACKAGE
  url: https://github.com/MISP/misp-modules
- type: PACKAGE
  url: https://pypi.org/project/misp-modules
- type: ADVISORY
  url: https://github.com/advisories/GHSA-fhq3-2gf3-8f3j
severity:
- type: CVSS_V4
  score: CVSS:4.0/AV:A/AC:L/AT:P/PR:N/UI:N/VC:L/VI:N/VA:N/SC:H/SI:H/SA:H