SPARQL Injection Vulnerability in MISP's Wikidata Lookup Expansion Module

CVE-2026-126991

What is CVE-2026-126991?

The Wikidata Lookup expansion module (wiki.py) in MISP has a vulnerability that enables authenticated users to exploit SPARQL queries through unvalidated user input. By directly concatenating user-supplied text into the query without proper escaping, an attacker can manipulate the logic of the query to extract unintended data or induce failures that may reveal internal details. Additionally, the flaw allows for leakage of sensitive information through improperly handled error responses, including potential exposure of proxy credentials and query contents. Although the vulnerability requires authenticated access to the MISP instance, careful handling of input and error responses is necessary to mitigate risks associated with this issue.

References