CVE-2026-112991

Name of the Vulnerable Software and Affected Versions MISP Modules (affected versions not specified)

Description The html to markdown expansion module contains a server-side request forgery (SSRF) issue within the is safe url() function. The BLOCKED RANGES list used to validate destination addresses was incomplete, failing to block several critical IP ranges including 0.0.0.0/8, 100.64.0.0/10, ::/128, fc00::/7, and fe80::/10. Additionally, IPv4-mapped IPv6 formats bypassed the validation checks. An authenticated user capable of creating or modifying attributes that trigger this module can provide URLs pointing to these internal ranges. Since the server fetches the content to convert HTML to Markdown, it can be abused as a proxy to probe and read responses from internal services, carrier-grade NAT infrastructure, or link-local endpoints that are otherwise inaccessible from external networks.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability. As a temporary workaround, restrict the use of the html to markdown expansion module.