GHSA-fhq3-2gf3-8f3j

Source

https://github.com/advisories/GHSA-fhq3-2gf3-8f3j

Import Source

https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/05/GHSA-fhq3-2gf3-8f3j/GHSA-fhq3-2gf3-8f3j.json

JSON Data

https://api.osv.dev/v1/vulns/GHSA-fhq3-2gf3-8f3j

Aliases

Published

2026-05-06T22:31:03Z

Modified

2026-07-13T16:43:14Z

Severity

5.8 (Medium) CVSS_V4 - CVSS:4.0/AV:A/AC:L/AT:P/PR:N/UI:N/VC:L/VI:N/VA:N/SC:H/SI:H/SA:H CVSS Calculator

Summary

misp-modules has nsafe remote resource fetching in expansion

Details

An unsafe remote resource fetching vulnerability existed in MISP Modules expansion modules. The html_to_markdown module accepted arbitrary HTTP(S) URLs without sufficient validation, which could allow Server-Side Request Forgery against loopback, private, or link-local network resources. Additionally, the qrcode module disabled TLS certificate verification when retrieving remote images, exposing requests to potential man-in-the-middle interception or response tampering. The issue was fixed by validating URL schemes, blocking local and private address ranges, resolving hostnames before fetching, enforcing request timeouts, and re-enabling TLS certificate verification. As reported by Bilal Teke.

Database specific

{
    "cwe_ids":  [
        "CWE-295",
        "CWE-918"
    ],
    "github_reviewed":  true,
    "github_reviewed_at":  "2026-05-06T22:31:03Z",
    "nvd_published_at":  "2026-05-13T20:16:23Z",
    "severity":  "MODERATE"
}

References

Affected packages

PyPI / misp-modules

Package

Name: misp-modules; View open source insights on deps.dev
Purl: pkg:pypi/misp-modules

Affected ranges

Type: ECOSYSTEM
Events: Introduced

0 Unknown introduced version / All previous versions are affected

Last Affected

3.0.7

Affected versions

2.*

2.4.196

2.4.197

2.4.198

2.4.199

2.4.200

2.4.201

3.*

3.0.0

3.0.1

3.0.2

3.0.4

3.0.5

3.0.6

3.0.7

Database specific

source

"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/05/GHSA-fhq3-2gf3-8f3j/GHSA-fhq3-2gf3-8f3j.json"