# CVE-2026-126991: SPARQL Injection in MISP Wikidata Lookup Module via Unescaped User Input

Status: published. Published: 2026-11-12. Updated: 2026-11-12.

The Wikidata Lookup expansion module (wiki.py) in MISP misp-modules contained a SPARQL injection vulnerability. The handler function constructed a SPARQL query by directly concatenating the user-supplied text value into the query string without any escaping or parameterization: 'SELECT ?item WHERE { ?item rdfs:label"' + request.get("text") + '" @en }'. An authenticated MISP user with access to the module could supply a crafted text attribute value containing SPARQL syntax (quotes, closing braces, UNION, SERVICE, LIMIT, etc.) to alter the structure of the query sent to the Wikidata SPARQL endpoint. This could allow an attacker to modify the query logic, extract unintended data, or cause the query to fail in ways that expose internal error details. Additionally, the old error handling path formatted raw exception objects into the response string ('wikidata API not accessible {}'.format(e)), potentially leaking internal information such as proxy credentials, query contents, or response bodies. The module also used a spoofed browser user-agent string and the deprecated Wikidata endpoint. The vulnerability required authenticated access to the MISP instance and the ability to invoke the wiki expansion module with a text attribute. The impact is limited to manipulation of the enrichment query and potential disclosure of internal error details; it does not directly compromise the MISP server or its stored data.

## Remediation

- fix: The vulnerability is remediated by properly escaping user-supplied text as a SPARQL string literal using json.dumps with ensure_ascii=False, which neutralizes quotes, backslashes, newlines, and control characters. Additional hardening includes strict validation of the language tag, numeric configuration values, text length, and UUID format before query construction; validation of Wikidata response structure and entity URI format before importing results; replacement of raw exception formatting with generic error messages that do not expose upstream details; use of the modern Wikidata SPARQL endpoint with POST method; a proper MISP user-agent string; and a bounded request timeout. (source: CNA: CIRCL)
- fix: The reporting source identifies this reference as a patch. Check the advisory for affected versions and supported release branches. (source: CNA: CIRCL) — https://github.com/MISP/misp-modules/commit/7a2a7e3d9e0f67f6732bd8050ab7da79e7b344d9

## Affected products and versions

- misp / misp-modules: ≤ 3.1.4 (affected, semver). Source: CNA: CIRCL

## Severity and prioritization

- CVSS 4.0: 5.3 (medium); CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N; source: CNA: CIRCL

- CISA KEV: No listing in collected sources

- EPSS: Not available

- SSVC: exploitation none; automatable yes; technical impact partial; source CNA: CIRCL

- Weaknesses: CWE-94, CWE-209

## Exploit evidence

No exploit evidence in collected sources. This is not proof of no exploitation.

## References

- https://github.com/MISP/misp-modules/commit/7a2a7e3d9e0f67f6732bd8050ab7da79e7b344d9 (CNA: CIRCL; patch)

- https://misp.github.io/misp-modules/expansion/#wikidata-lookup (CNA: CIRCL)

- https://github.com/MISP/misp-modules/pull/869 (CNA: CIRCL)

- https://github.com/MISP/misp-modules (CNA: CIRCL)

## Provenance

- CNA: CIRCL: https://www.cve.org/CVERecord?id=CVE-2026-126991; retrieved 2026-11-12; source updated 2026-11-12

Revision: 544a9d4047a2aa4c65bef1dadee92a3b4d73453c8bdffa6ebf9edc9d23eac277

Canonical: https://y2.dev/cve/CVE-2026-126991

## Agent and API access

Public CVE pages, Markdown, and JSON are free to read without an account or API key.

- Public catalog: https://y2.dev/cve/index.json. Follow nextCursor with the same search, filters, sort, and limit (1–100). A null cursor marks the end.

- WebMCP: search_cve_disclosures, get_cve_disclosure, get_cve_page_markdown, get_y2_cve_access. Available in compatible browsers.

- Cyber API: https://api.y2.dev/api/v2/cyber/cves and https://api.y2.dev/api/v2/cyber/cves/{cveId}.

- Y2 Pro or Elite: create a workspace API key with the intel:cyber scope and send Authorization: Bearer <Y2_API_KEY>. Setup: https://y2.dev/docs/api/create-key.

- x402: Pay per request without an account or API key. Omit Authorization, read the HTTP 402 PAYMENT-REQUIRED challenge, validate its current requirements, and retry with PAYMENT-SIGNATURE through an authorized payment client. These browser tools never make payments. Guide: https://y2.dev/docs/api/x402.

- OpenAPI: https://y2.dev/api/openapi.yaml. Agent access metadata: https://y2.dev/cve/agent.json.

Collected public records only. Check source status for coverage and freshness.