MISP misp-modules CVE-2026-97863

Exploitation requires (1) the attacker to have MISP event/attribute submission privileges and to submit an ip-dst, url, or event-info value containing a single-quote character with appended shell commands; and (2) the specific cisco_firesight_manager_ACL_rule_export module to be used to generate the .sh export, which is then executed unmodified by a victim analyst on their workstation (CVSS UI:A - active user interaction). Limiting factors: the flaw does not compromise misp-modules or the MISP server itself (subsequent-system impact only); no code runs until a human runs the generated script; the target Cisco fireSIGHT export workflow is niche. The secondary NameError DoS triggers only when a request payload omits the 'config' key.

This is a genuine but conditional risk, not an inflated high-CVSS finding. The CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:L/UI:A) scores 6.3 (Medium) and honestly captures the two gating factors: the attacker needs standard MISP event-submission privileges (PR:L) and the victim analyst must actively execute the generated .sh file unmodified (UI:A - Active interaction). Critically, all vulnerable-system impacts are None (VC:N/VI:N/VA:N) while all subsequent-system impacts are High (SC:H/SI:H/SA:H) - meaning misp-modules itself is not compromised; the damage lands on the analyst's workstation (arbitrary command execution, fireSIGHT credential exposure, ACL tampering). No EPSS score, no CISA KEV listing, and no public exploit are provided, so exploitation status is: no public exploit identified at time of analysis. The signals are internally consistent - moderate CVSS, no KEV, no POC - pointing to a real code-injection defect that requires a specific social/operational precondition (an analyst running a poisoned export) rather than a wormable or mass-exploitable flaw. The description explicitly states no authentication bypass is required beyond event submission, which directly contradicts the 'Authentication Bypass' tag in the metadata.

An attacker with rights to submit events/attributes to a MISP instance (e.g., a partner in a sharing community) submits an ip-dst or url attribute value containing a single-quote character followed by shell commands. When a security analyst uses the cisco_firesight_manager_ACL_rule_export module to generate the .sh script and runs it unmodified to push ACL rules to fireSIGHT Manager, the payload breaks out of the single-quoted string and the injected commands execute with the analyst's privileges. No public proof-of-concept is identified at time of analysis.