{"id":"CVE-2026-126991","kind":"vulnerability","aliases":["CVE-2026-126991"],"related":[],"title":"MISP Wikidata enrichment module: SPARQL injection via text attribute","description":"The Wikidata Lookup expansion module (wiki.py) in MISP misp-modules contained a SPARQL injection vulnerability. The handler function constructed a SPARQL query by directly concatenating the user-supplied text value into the query string without any escaping or parameterization: 'SELECT ?item WHERE { ?item rdfs:label\"' + request.get(\"text\") + '\" @en }'. An authenticated MISP user with access to the module could supply a crafted text attribute value containing SPARQL syntax (quotes, closing braces, UNION, SERVICE, LIMIT, etc.) to alter the structure of the query sent to the Wikidata SPARQL endpoint. This could allow an attacker to modify the query logic, extract unintended data, or cause the query to fail in ways that expose internal error details. Additionally, the old error handling path formatted raw exception objects into the response string ('wikidata API not accessible {}'.format(e)), potentially leaking internal information such as proxy credentials, query contents, or response bodies. The module also used a spoofed browser user-agent string and the deprecated Wikidata endpoint. The vulnerability required authenticated access to the MISP instance and the ability to invoke the wiki expansion module with a text attribute. The impact is limited to manipulation of the enrichment query and potential disclosure of internal error details; it does not directly compromise the MISP server or its stored data.","summary":"The MISP misp-modules Wikidata Lookup expansion module built its SPARQL query by concatenating user-supplied text into the query string without escaping. An authenticated MISP user can alter the query sent to Wikidata and, through verbose error messages, may expose internal error details.","severity":"medium","cvss":5.3,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["misp","misp-modules","package","threat-intel"],"not_affected_if":["auth-required","module-not-installed"],"how_to_check":"- Check whether your MISP instance runs misp-modules with the wiki expansion module (wiki.py) installed.\n- Check the installed misp-modules version against the fixed version; the sources do not name one, so unknown.","fix":null,"status":"open","published_at":"2026-11-12T08:16:41+00:00","first_seen_at":"2026-11-12T08:37:14+00:00","triaged_at":"2026-11-12T08:38:38+00:00","updated_at":"2026-11-12T08:38:38+00:00","category":"package","confidence":0.7,"triage":{"at":"2026-11-12T08:38:38Z","model":"claude-haiku-5-5","output":{"fix":"- unknown: the sources point to a patch on GitHub but do not state a fixed version.","reach":"network","title":"MISP Wikidata enrichment module: SPARQL injection via text attribute","impact":"low","summary":"The MISP misp-modules Wikidata Lookup expansion module built its SPARQL query by concatenating user-supplied text into the query string without escaping. An authenticated MISP user can alter the query sent to Wikidata and, through verbose error messages, may expose internal error details.","audience":"businesses","category":"package","nicknames":[],"who_cares":["misp","misp-modules","threat-intel"],"confidence":0.7,"fix_status":"unknown","needs_auth":"yes","worst_case":"Attacker alters Wikidata query and leaks internal error details","analyst_note":"Confirm the fixed misp-modules version from the GitHub patch linked in the sources and record it in fix.","how_to_check":"- Check whether your MISP instance runs misp-modules with the wiki expansion module (wiki.py) installed.\n- Check the installed misp-modules version against the fixed version; the sources do not name one, so unknown.","plain_action":"","product_name":"","needs_analyst":true,"not_affected_if":["module-not-installed","auth-required"],"who_is_affected":"Teams running MISP with misp-modules and the Wikidata Lookup expansion module enabled. Exposure requires an authenticated MISP user with access to that module who can submit a text attribute to it. Instances without that module, or without untrusted authenticated users, are lower risk.","user_interaction":"no","product_ecosystem":"","needs_special_setup":"yes","severity_if_unknown":"medium"},"cost_usd":0.000785,"input_tokens":4933,"output_tokens":583,"severity_before":"medium"},"analyst_status":null,"analyst_note":null,"search":"'-126991':12A,15A '-2026':11A,14A 'abil':245C 'access':125C,202C,238C 'addit':185C 'agent':227C 'allow':161C 'also':220C 'alter':54B,147C 'api':200C 'attack':163C 'attribut':9A,134C,255C 'authent':50B,121C,237C 'bodi':217C 'brace':141C 'browser':224C 'built':33B 'caus':173C 'close':140C 'compromis':277C 'concaten':38B,95C 'construct':89C 'contain':81C,136C 'content':214C 'could':129C,160C 'craft':132C 'credenti':212C 'cve':10A,13A 'data':171C,284C 'deprec':231C 'detail':69B,184C,272C 'direct':94C,276C 'disclosur':268C 'e':204C 'en':119C 'endpoint':158C,233C 'enrich':3A,264C 'error':63B,68B,183C,188C,271C 'escap':48B,108C 'etc':145C 'except':193C 'expans':31B,73C,250C 'expos':66B,181C 'extract':169C 'fail':177C 'format':191C,203C 'function':88C 'handl':189C 'handler':87C 'impact':257C 'inform':208C 'inject':6A,84C 'instanc':242C 'intel':23B 'intern':67B,182C,207C,270C 'invok':247C 'item':112C,114C 'label':116C 'leak':206C 'limit':144C,259C 'logic':168C 'lookup':30B,72C 'manipul':261C 'may':65B 'messag':64B 'misp':1A,16B,18B,25B,27B,51B,77C,79C,122C,241C,279C 'misp-modul':17B,26B,78C 'modifi':165C 'modul':4A,19B,28B,32B,74C,80C,128C,219C,251C 'object':194C 'old':187C 'packag':20B 'parameter':110C 'path':190C 'potenti':205C,267C 'proxi':211C 'queri':36B,45B,56B,92C,104C,152C,167C,175C,213C,265C 'quot':139C 'raw':192C 'rdfs':115C 'request.get':117C 'requir':236C 'respons':197C,216C 'select':111C 'sent':57B,153C 'server':280C 'servic':143C 'sparql':5A,35B,83C,91C,137C,157C 'spoof':223C 'store':283C 'string':46B,105C,198C,228C 'structur':149C 'suppli':41B,99C,130C 'syntax':138C 'text':8A,42B,100C,118C,133C,254C 'threat':22B 'threat-intel':21B 'unintend':170C 'union':142C 'use':221C 'user':40B,52B,98C,123C,226C 'user-ag':225C 'user-suppli':39B,97C 'valu':101C,135C 'verbos':62B 'via':7A 'vulner':85C,235C 'way':179C 'wiki':249C 'wiki.py':75C 'wikidata':2A,29B,59B,71C,156C,199C,232C 'without':47B,106C","nicknames":[],"mitigations":[],"who_affected":"Teams running MISP with misp-modules and the Wikidata Lookup expansion module enabled. Exposure requires an authenticated MISP user with access to that module who can submit a text attribute to it. Instances without that module, or without untrusted authenticated users, are lower risk.","tier":"C","verified":{},"analyst_revisit_at":null,"fix_status":"none","audience":"businesses","plain_action":null,"pkeys":[],"ptokens":[],"labels":["medium","misp","mispmodules","package","threatintel"],"campaign_type":null,"search_a":"'-126991':12A,15A '-2026':11A,14A 'attribut':9A 'cve':10A,13A 'enrich':3A 'inject':6A 'misp':1A 'modul':4A 'sparql':5A 'text':8A 'via':7A 'wikidata':2A","search_b":"'alter':54B 'authent':50B 'built':33B 'concaten':38B 'detail':69B 'error':63B,68B 'escap':48B 'expans':31B 'expos':66B 'intel':23B 'intern':67B 'lookup':30B 'may':65B 'messag':64B 'misp':16B,18B,25B,27B,51B 'misp-modul':17B,26B 'modul':19B,28B,32B 'packag':20B 'queri':36B,45B,56B 'sent':57B 'sparql':35B 'string':46B 'suppli':41B 'text':42B 'threat':22B 'threat-intel':21B 'user':40B,52B 'user-suppli':39B 'verbos':62B 'wikidata':29B,59B 'without':47B","search_c":"'abil':245C 'access':125C,202C,238C 'addit':185C 'agent':227C 'allow':161C 'also':220C 'alter':147C 'api':200C 'attack':163C 'attribut':134C,255C 'authent':121C,237C 'bodi':217C 'brace':141C 'browser':224C 'caus':173C 'close':140C 'compromis':277C 'concaten':95C 'construct':89C 'contain':81C,136C 'content':214C 'could':129C,160C 'craft':132C 'credenti':212C 'data':171C,284C 'deprec':231C 'detail':184C,272C 'direct':94C,276C 'disclosur':268C 'e':204C 'en':119C 'endpoint':158C,233C 'enrich':264C 'error':183C,188C,271C 'escap':108C 'etc':145C 'except':193C 'expans':73C,250C 'expos':181C 'extract':169C 'fail':177C 'format':191C,203C 'function':88C 'handl':189C 'handler':87C 'impact':257C 'inform':208C 'inject':84C 'instanc':242C 'intern':182C,207C,270C 'invok':247C 'item':112C,114C 'label':116C 'leak':206C 'limit':144C,259C 'logic':168C 'lookup':72C 'manipul':261C 'misp':77C,79C,122C,241C,279C 'misp-modul':78C 'modifi':165C 'modul':74C,80C,128C,219C,251C 'object':194C 'old':187C 'parameter':110C 'path':190C 'potenti':205C,267C 'proxi':211C 'queri':92C,104C,152C,167C,175C,213C,265C 'quot':139C 'raw':192C 'rdfs':115C 'request.get':117C 'requir':236C 'respons':197C,216C 'select':111C 'sent':153C 'server':280C 'servic':143C 'sparql':83C,91C,137C,157C 'spoof':223C 'store':283C 'string':105C,198C,228C 'structur':149C 'suppli':99C,130C 'syntax':138C 'text':100C,118C,133C,254C 'unintend':170C 'union':142C 'use':221C 'user':98C,123C,226C 'user-ag':225C 'user-suppli':97C 'valu':101C,135C 'vulner':85C,235C 'way':179C 'wiki':249C 'wiki.py':75C 'wikidata':71C,156C,199C,232C 'without':106C","cause_entry":null,"cause_path":null,"disclosures_checked_at":null,"first_public_at":"2026-11-12T08:16:41+00:00","kev":null,"cvss_vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","cvss_by":"5a6e4751-2f3f-4070-9419-94fb35b644e8","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-126991","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-126991","severity":null,"published_at":"2026-11-12T08:16:41+00:00","modified_at":"2026-11-12T08:16:41+00:00","first_seen_at":"2026-11-12T08:37:14+00:00","fetched_at":"2026-11-12T08:37:14+00:00","note":null}],"documents":[{"id":133155,"url":"https://github.com/MISP/misp-modules/commit/7a2a7e3d9e0f67f6732bd8050ab7da79e7b344d9","title":"Patch: github.com","kind":"other","source":"nvd","publisher":"vendor","text":null,"published_at":null,"relation":"fix","confidence":null,"note":"Patch: github.com"}],"disclosures":[],"exploit_sources":[],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}