{"schema":"voidly-atlas-federal-record/v1","dataset":"nvd-cves","agency":"NIST","source":"NIST National Vulnerability Database","provider":"Voidly","license":"Source data is U.S. federal public domain (17 U.S.C. §105). Re-surfaced by Voidly under CC BY 4.0.","disclaimer":"This is the agency's own public-domain data, curated and made citable by Voidly. Voidly adds no independent claim — always verify against the linked canonical source.","generated_at":"2026-10-20T15:15:12.961Z","record":{"id":"CVE-2026-112991","cve_id":"CVE-2026-112991","published":"2026-10-19T23:17:36.350","last_modified":"2026-10-19T23:17:36.350","status":"Received","description":"The html_to_markdown expansion module in MISP Modules contains a server-side request forgery (SSRF) vulnerability in its is_safe_url() URL validation function. The BLOCKED_RANGES list used to reject unsafe destination addresses was incomplete, omitting several critical IP address ranges. Specifically, the following ranges were not blocked: 0.0.0.0/8 (unspecified, which routes to loopback on Linux), 100.64.0.0/10 (carrier-grade NAT per RFC 6598), ::/128 (IPv6 unspecified), fc00::/7 (IPv6 Unique Local Addresses), and fe80::/10 (IPv6 link-local). The existing list only covered IPv4 loopback (127.0.0.0/8), RFC 1918 private ranges, IPv4 link-local (169.254.0.0/16), and IPv6 loopback (::1/128).\n\nAn authenticated user with the ability to create or modify MISP attributes that trigger the html_to_markdown expansion module could supply URLs pointing to these unblocked internal address ranges. Because the module fetches the URL server-side to convert HTML content to Markdown, the request is made from the MISP server's network context. This allows an attacker to probe and read responses from internal services, carrier-grade NAT infrastructure, or link-local endpoints that would otherwise be un","cvss_score":null,"cvss_severity":null,"cvss_vector":null,"cwes":"CWE-20|CWE-918","cpe_count":0,"source_url":"https://nvd.nist.gov/vuln/detail/CVE-2026-112991","voidly_url":"https://voidly.ai/atlas/federal/nvd-cves/CVE-2026-112991"},"citation":{"voidly_url":"https://voidly.ai/atlas/federal/nvd-cves/CVE-2026-112991","source_url":"https://nvd.nist.gov/vuln/detail/CVE-2026-112991","recommended":"CVE-2026-112991 — CVE. NIST, via Voidly Atlas — Surveillance & Digital-Rights Watch. Retrieved 2026-10-20, https://voidly.ai/atlas/federal/nvd-cves/CVE-2026-112991","ris":"TY  - DATA\nTI  - CVE-2026-112991 — CVE\nAU  - Voidly\nT2  - Voidly Atlas — Surveillance & Digital-Rights Watch\nPB  - Voidly\nPY  - 2026\nUR  - https://voidly.ai/atlas/federal/nvd-cves/CVE-2026-112991\nN1  - Source: NIST National Vulnerability Database, https://nvd.nist.gov/vuln/detail/CVE-2026-112991. Public domain (17 U.S.C. §105); re-surfaced under CC BY 4.0\nER  - ","apa":"Voidly. (2026). CVE-2026-112991 — CVE [NIST National Vulnerability Database]. Voidly Atlas. Retrieved 2026-10-20, from https://voidly.ai/atlas/federal/nvd-cves/CVE-2026-112991","bibtex":"@misc{voidly_nvd_cves_CVE2026112991,\n  title        = {CVE-2026-112991 — CVE},\n  author       = {{Voidly}},\n  howpublished = {\\url{https://voidly.ai/atlas/federal/nvd-cves/CVE-2026-112991}},\n  note         = {Source: NIST National Vulnerability Database, https://nvd.nist.gov/vuln/detail/CVE-2026-112991. Public domain (17 U.S.C. §105); re-surfaced under CC BY 4.0},\n  urldate      = {2026-10-20},\n  year         = {2026}\n}"}}