CVE-2026-126991: SPARQL Injection in MISP Wikidata Lookup Module via Unescaped User Input
The Wikidata Lookup expansion module (wiki.py) in MISP misp-modules contained a SPARQL injection vulnerability. The handler function constructed a SPARQL query by directly concatenating the user-supplied text value into the query string without any escaping or parameterization: 'SELECT ?item WHERE { ?item rdfs:label"' + request.get("text") + '" @en }'. An authenticated MISP user with access to the module could supply a crafted text attribute value containing SPARQL syntax (quotes, closing braces, UNION, SERVICE, LIMIT, etc.) to alter the structure of the query sent to the Wikidata SPARQL endpoint. This could allow an attacker to modify the query logic, extract unintended data, or cause the query to fail in ways that expose internal error details. Additionally, the old error handling path formatted raw exception objects into the response string ('wikidata API not accessible {}'.format(e)), potentially leaking internal information such as proxy credentials, query contents, or response bodies. The module also used a spoofed browser user-agent string and the deprecated Wikidata endpoint. The vulnerability required authenticated access to the MISP instance and the ability to invoke the wiki expansion module with a text attribute. The impact is limited to manipulation of the enrichment query and potential disclosure of internal error details; it does not directly compromise the MISP server or its stored data.
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Configuration
Use the modern Wikidata SPARQL endpoint and send requests with the POST method instead of the deprecated endpoint.
MISP Wikidata Lookup module Wikidata request endpoint and method = modern Wikidata SPARQL endpoint; POST - Configuration
Set a proper MISP user-agent string for requests to Wikidata instead of the spoofed browser user-agent.
MISP Wikidata Lookup module User-Agent = proper MISP user-agent string - Configuration
Configure a bounded timeout for requests to the Wikidata SPARQL endpoint.
MISP Wikidata Lookup module request timeout = bounded - Compensating control
Escape the user-supplied text as a SPARQL string literal with json.dumps(..., ensure_ascii=False) before constructing the Wikidata query, neutralizing quotes, backslashes, newlines, and control characters.
- Compensating control
Strictly validate the language tag, numeric configuration values, text length, and UUID format before constructing the query.
- Compensating control
Validate the Wikidata response structure and entity URI format before importing results.
- Compensating control
Replace raw exception formatting such as 'wikidata API not accessible {}'.format(e) with generic error messages that do not expose upstream details, proxy credentials, query contents, or response bodies.
Event History
Frequently Asked Questions
Who can exploit this issue?
An attacker needs authenticated access to the MISP instance, permission to use the Wikidata Lookup expansion module, and the ability to submit a crafted text attribute value to the module.
What can an attacker achieve through the injected query?
They may alter the SPARQL query sent to the Wikidata endpoint, potentially retrieving unintended data or causing query failures. Failure responses may also expose internal error details, including query contents, proxy credentials, or response bodies.
How can I check whether my deployment contains the vulnerable implementation?
Inspect the Wikidata Lookup module's wiki.py handler for construction of a SPARQL query by concatenating request.get("text") directly into the query string. Also check whether exceptions are returned using raw formatting such as "wikidata API not accessible {}".format(e).