{"id":"CVE-2026-44363","aliases":["GHSA-fhq3-2gf3-8f3j","PYSEC-2026-2650"],"title":"misp-modules has nsafe remote resource fetching in expansion","summary":"misp-modules has nsafe remote resource fetching in expansion","severity":"medium","vendor":"misp-modules","product":"misp-modules","ecosystem":"pip","affected":["misp-modules <= 3.0.7"],"published":"2026-05-06","updated":"2026-07-13","source":"OSV","sourceUrl":"https://osv.dev/vulnerability/GHSA-fhq3-2gf3-8f3j","references":[{"url":"https://github.com/MISP/misp-modules/security/advisories/GHSA-fhq3-2gf3-8f3j"},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-44363"},{"url":"https://github.com/MISP/misp-modules/commit/01a522f2772fc31eeed379ccf23750c8a3d401db"},{"url":"https://github.com/MISP/misp-modules"}],"tags":["osv","pip"],"epss":0.0013,"epssPercentile":0.02135,"ingestedAt":"2026-07-13T18:57:57.393Z","slug":"CVE-2026-44363","body":"## Overview\n\nAn unsafe remote resource fetching vulnerability existed in MISP Modules expansion modules. The html_to_markdown module accepted arbitrary HTTP(S) URLs without sufficient validation, which could allow Server-Side Request Forgery against loopback, private, or link-local network resources. Additionally, the qrcode module disabled TLS certificate verification when retrieving remote images, exposing requests to potential man-in-the-middle interception or response tampering. The issue was fixed by validating URL schemes, blocking local and private address ranges, resolving hostnames before fetching, enforcing request timeouts, and re-enabling TLS certificate verification. As reported by Bilal Teke.\n\n## Affected packages\n\n- `misp-modules <= 3.0.7`\n\n## Remediation\n\nRefer to the advisory for the patched release.","depth":"sunlit","depthScore":28,"depthScoreParts":{"impact":27.5,"likelihood":0,"exploitation":0,"ransomware":0},"changes":[]}