CVE-2026-126991— SPARQL Injection in MISP Wikidata Lookup Module via Unescaped User Input

Quick assessment

Affected

misp misp-modules

Exploitation

No confirmed in-the-wild exploitation; assess based on exposure

Recommended action

Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.

MISP 中的组件里，Wikidata 查询扩展模块（）存在 SPARQL 注入漏洞。该模块的处理函数在构建 SPARQL 查询时，将用户提供的文本值直接拼接到查询字符串中，未进行任何转义或参数化处理，具体代码形式为：。拥有模块访问权限的已认证 MISP 用户可以提交精心构造的文本属性值，其中包含 SPARQL 语法元素（如引号、闭合大括号、UNION、SERVICE、LIMIT 等），从而篡改发送至 Wikidata SPARQL 端点的查询结构。攻击者借此可修改查询逻辑、提取非预期数据，或使查询以暴露内部

CVSS 5.3 · Medium Updated Nov 12, 2026

Get alerts for future matching vulnerabilities Log in to subscribe

Vulnerability Information

Have questions about the vulnerability? See if Shenlong's analysis helps!

View Shenlong Deep Dive ↗

Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.

Vulnerability Title

SPARQL Injection in MISP Wikidata Lookup Module via Unescaped User Input

Source: CVE Program / CVE List V5

Vulnerability Description

The Wikidata Lookup expansion module (wiki.py) in MISP misp-modules contained a SPARQL injection vulnerability. The handler function constructed a SPARQL query by directly concatenating the user-supplied text value into the query string without any escaping or parameterization: 'SELECT ?item WHERE { ?item rdfs:label"' + request.get("text") + '" @en }'. An authenticated MISP user with access to the module could supply a crafted text attribute value containing SPARQL syntax (quotes, closing braces, UNION, SERVICE, LIMIT, etc.) to alter the structure of the query sent to the Wikidata SPARQL endpoint. This could allow an attacker to modify the query logic, extract unintended data, or cause the query to fail in ways that expose internal error details. Additionally, the old error handling path formatted raw exception objects into the response string ('wikidata API not accessible {}'.format(e)), potentially leaking internal information such as proxy credentials, query contents, or response bodies. The module also used a spoofed browser user-agent string and the deprecated Wikidata endpoint. The vulnerability required authenticated access to the MISP instance and the ability to invoke the wiki expansion module with a text attribute. The impact is limited to manipulation of the enrichment query and potential disclosure of internal error details; it does not directly compromise the MISP server or its stored data.

Source: CVE Program / CVE List V5

CVSS Information

CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N

Source: CVE Program / CVE List V5

Vulnerability Type

对生成代码的控制不恰当(代码注入)

Source: CVE Program / CVE List V5

Affected Products

Vendor	Product	Affected Versions	CPE	Subscribe
misp	misp-modules	unspecified ~ 3.1.4	`cpe:2.3:a:misp:misp-modules::::::::`

II. Public POCs for CVE-2026-126991

#	POC Description	Source Link	Shenlong Link

AI-Generated POC Premium

No public POC found.

III. Intelligence Information for CVE-2026-126991

请登录查看更多情报信息。

Other References for CVE-2026-126991 (4)

https://www.cve.org/CVERecord?id=CVE-2026-126991

IV. Related Vulnerabilities

Same product: misp-modules

Same vendor: misp

Same weakness: CWE-94