MISP: Four STIX Handling Vulnerabilities Disclosed Together, Two High Severity
Four vulnerabilities, including two High severity flaws, were disclosed in MISP's STIX handling components on August 21, 2026, impacting data integrity and system stability.
Key findings
- Four vulnerabilities in MISP's STIX processing disclosed on August 21, 2026.
- Includes two High severity flaws: a DoS via sys.exit() and a path traversal in object template handling.
- Parser state isolation (CVE-2026-77761) could lead to data contamination between STIX documents.
- A crafted STIX document could influence MISP attribute metadata during import (CVE-2026-77710).
On August 21, 2026, a batch of four vulnerabilities was disclosed in MISP's STIX handling components, with a disclosure window spanning just two hours. These vulnerabilities, identified as CVE-2026-77761, CVE-2026-77755, CVE-2026-77751, and CVE-2026-77710, highlight potential risks in how MISP processes and integrates data from STIX documents. The cluster of vulnerabilities, including two rated High severity, underscores the importance of secure parsing and data handling in threat intelligence platforms.
Several issues stem from the misp-stix library's handling of STIX data. CVE-2026-77761, a parser state isolation vulnerability, could lead to data from a previously processed STIX document being incorrectly retained and merged into a new MISP event if the same parser instance is reused. This affects both STIX 1 and STIX 2 parsers that maintain per-document state.
A critical denial-of-service vulnerability, CVE-2026-77755, was identified due to the STIX import code's use of sys.exit() to handle parsing and loading failures. Because SystemExit bypasses standard exception handling, these failures could lead to unexpected application termination when processing attacker-controlled STIX 1 or STIX 2 documents.
Furthermore, CVE-2026-77751 points to a path traversal vulnerability within the MISP object template naming during STIX 2 import and export. This flaw arises when MISP object names are resolved against the filesystem, potentially allowing malicious actors to access unintended directories.
Finally, CVE-2026-77710, a medium-severity vulnerability, could permit a crafted STIX document to influence sensitive MISP attribute metadata during the import process. The STIX import logic's dynamic selection between internal and external parsers, based on document metadata, is exploited here.
Details regarding specific affected versions and patch availability were not immediately detailed in the disclosure, but users of MISP are advised to consult official MISP security advisories for the latest information and mitigation steps. Addressing these vulnerabilities is crucial for maintaining the integrity and security of threat intelligence data within MISP.