---
id: "CVE-2026-44363"
page: "https://infrastack.ai/live/CVE-2026-44363"
kind: "vulnerability"
aliases: ["CVE-2026-44363", "GHSA-fhq3-2gf3-8f3j"]
title: "misp-modules has unsafe remote resource fetching in expansion"
severity: "medium"
cvss: 5.8
epss: 0.00102
exploited: false
status: "open"
category: "package"
products: [{"name": "misp-modules", "fixed": ["3.0.8"], "affected": "< 3.0.8", "ecosystem": "pypi"}]
ecosystems: ["pypi"]
tags: ["cwe-295", "cwe-918", "misp", "misp-modules", "package", "pypi", "self-hosted"]
not_affected_if: ["fixed-version", "modules-disabled"]
published_at: "2026-05-06T22:31:03+00:00"
first_seen_at: "2026-11-07T00:19:59+00:00"
updated_at: "2026-11-07T00:44:49+00:00"
sources: [{"source": "ghsa", "url": "https://github.com/advisories/GHSA-fhq3-2gf3-8f3j", "first_seen_at": "2026-11-07T00:19:59+00:00"}, {"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-44363", "first_seen_at": "2026-11-07T00:44:49+00:00"}]
exploit_sources: [{"type": "epss", "score": 0.00102, "url": "https://api.first.org/data/v1/epss?cve=CVE-2026-44363"}]
---

# misp-modules has unsafe remote resource fetching in expansion

Link for people: https://infrastack.ai/live/CVE-2026-44363 (this .md is for agents)

The html_to_markdown expansion module fetched arbitrary HTTP(S) URLs without enough validation, so a request could reach loopback, private, or link-local services (server-side request forgery). The qrcode module also turned off TLS certificate verification when fetching remote images, so those responses could be intercepted or altered.

_Summary, check and fix written by a model from the sources; labelled as such._

## Affected

- pypi:misp-modules affected < 3.0.8 fixed 3.0.8

## How to check

- Check the installed version with `pip show misp-modules` and compare it with the fixed version.
- Confirm whether the html_to_markdown and qrcode expansion modules are enabled in your misp-modules deployment.

## Fix

- misp-modules: upgrade to `3.0.8` or later (fixed in 3.0.8, affected below 3.0.8).

## Timeline

- 2026-11-07T00:19:59+00:00 ghsa https://github.com/advisories/GHSA-fhq3-2gf3-8f3j
- 2026-11-07T00:44:49+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-44363

## Documents

- [advisory] Maintainer's advisory: api.github.com https://api.github.com/repos/MISP/misp-modules/security-advisories/GHSA-fhq3-2gf3-8f3j
- [advisory] Maintainer's advisory: github.com https://github.com/MISP/misp-modules/security/advisories/GHSA-fhq3-2gf3-8f3j
- [fix] Patch: github.com https://github.com/MISP/misp-modules/commit/52cda9caa003cafe87e14ae3721db5e16f6f111a
- [fix] Patch: github.com https://github.com/MISP/misp-modules/commit/01a522f2772fc31eeed379ccf23750c8a3d401db

## From the sources

MISP modules are autonomous modules that can be used to extend MISP for new services. Prior to 3.0.7, an unsafe remote resource fetching vulnerability existed in MISP Modules expansion modules. The html_to_markdown module accepted arbitrary HTTP(S) URLs without sufficient validation, which could allow Server-Side Request Forgery against loopback, private, or link-local network resources. Additionally, the qrcode module disabled TLS certificate verification when retrieving remote images, exposing requests to potential man-in-the-middle interception or response tampering. The issue was fixed by validating URL schemes, blocking local and private address ranges, resolving hostnames before fetching, enforcing request timeouts, and re-enabling TLS certificate verification. This vulnerability is fixed in 3.0.7.

---

_Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai_