CVE-2026-112991

The html_to_markdown expansion module in MISP Modules contains a server-side request forgery (SSRF) vulnerability in its is_safe_url() URL validation function. The BLOCKED_RANGES list used to reject unsafe destination addresses was incomplete, omitting several critical IP address ranges. Specifically, the following ranges were not blocked: 0.0.0.0/8 (unspecified, which routes to loopback on Linux), 100.64.0.0/10 (carrier-grade NAT per RFC 6598), ::/128 (IPv6 unspecified), fc00::/7 (IPv6 Unique Local Addresses), and fe80::/10 (IPv6 link-local). The existing list only covered IPv4 loopback (127.0.0.0/8), RFC 1918 private ranges, IPv4 link-local (169.254.0.0/16), and IPv6 loopback (::1/128). An authenticated user with the ability to create or modify MISP attributes that trigger the html_to_markdown expansion module could supply URLs pointing to these unblocked internal address ranges. Because the module fetches the URL server-side to convert HTML content to Markdown, the request is made from the MISP server's network context. This allows an attacker to probe and read responses from internal services, carrier-grade NAT infrastructure, or link-local endpoints that would otherwise be unreachable from external networks. IPv4-mapped IPv6 forms (e.g., [::ffff:0.0.0.0]) also bypassed the existing checks. The security impact is primarily confidentiality: an attacker can read data served by internal services reachable from the MISP server. The MISP instance itself is not compromised, but it is abused as a proxy to access otherwise restricted network resources.

• CWE-20
• CWE-918

• https://github.com/misp/misp-modules/commit/98a1c2c2f297665dd8d4609e9cd644007a57516b

Published

Oct 19, 2026

Last Modified

Oct 20, 2026

Status

Deferred

• One Click Account Takeover in GranolaHow a notification link broke out of Electron and led to a one-click account takeover.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2026-112957ApostropheCMS is an open-source Node.js content management s…4.3
• CVE-2026-112958ApostropheCMS is an open-source Node.js content management s…5.4
• CVE-2026-11296Inappropriate implementation in ImageCapture in Google Chrom…7.5
• CVE-2026-11297Insufficient validation of untrusted input in Reader Mode in…7.7
• CVE-2026-11298Inappropriate implementation in Chrome for iOS in Google Chr…4.3
• CVE-2026-11299Integer overflow in Fonts in Google Chrome prior to 149.0.78…6.5
• CVE-2026-112992Memory corruption in Canvas in Google Chrome prior to 156.0.…9.6
• CVE-2026-112993Use after free in Input in Google Chrome prior to 156.0.8078…8.8
• CVE-2026-112994Memory corruption in Browser in Google Chrome prior to 156.0…8.8
• CVE-2026-112995Use after free in Animation in Google Chrome prior to 156.0.…8.8
• CVE-2026-112996Memory corruption in Loader in Google Chrome prior to 156.0.…8.8
• CVE-2026-112997Memory corruption in CSS in Google Chrome prior to 156.0.807…8.8