CVE-2026-97863

Name of the Vulnerable Software and Affected Versions misp-modules (affected versions not specified)

Description The cisco firesight manager ACL rule export module generates a shell script (.sh) that authenticates to and calls the Cisco fireSIGHT Manager API. The module interpolates configuration values and MISP attribute values—such as destination IPs, URLs, and event info comments—directly into single-quoted shell string assignments without escaping or sanitization. An attacker can inject arbitrary shell commands by submitting MISP events or attributes containing a single-quote character, which breaks the quoting context. A security analyst executing the resulting script would run these commands with their own privileges, potentially compromising their workstation or exposing fireSIGHT Manager credentials. Additionally, the module contains a defect where the config variable is referenced unconditionally despite being assigned only within a conditional block, leading to a NameError and causing a denial of service when the request payload lacks a config key.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.