{"answers":{"affected":"","exploited":"There is no known exploitation of CVE-2026-77710 in the wild and no public exploit code.","fix":"No fix has been published for CVE-2026-77710 yet. Limit exposure of the affected software until one is available.","what":"CVE-2026-77710 is a medium-severity vulnerability in misp-stix, published on 21 Aug 2026. An attacker can exploit it over the internet without logging in, with no action from the victim."},"fix_prompt":"Check this codebase for CVE-2026-77710 and fix it if it is affected.\n\nWhat it is: CVE-2026-77710 is a medium-severity vulnerability in misp-stix, published on 21 Aug 2026. An attacker can exploit it over the internet without logging in, with no action from the victim.\nExploitation: There is no known exploitation of CVE-2026-77710 in the wild and no public exploit code.\n\nAffected product: misp-stix. No package-level version data is available, so check the vendor advisory linked from the reference page.\n\nTask:\n1. Search the dependency manifests and lockfiles (for example package.json, package-lock.json, requirements.txt, poetry.lock, uv.lock, pom.xml, build.gradle, go.mod, Cargo.lock, Gemfile.lock) and any Dockerfiles for the affected packages, including transitive dependencies.\n2. If an affected version is in use, upgrade it to the fixed version for its release line with the project's package manager, so the lockfile is regenerated. Prefer the smallest upgrade that fixes it.\n3. If there is no fix, or the upgrade would break the build, do not guess: explain the risk and the safest workaround instead.\n4. Run the tests and summarise what changed and why.\n5. If nothing in the project is affected, say so and change nothing.\n\nReference: https://insights.sbomify.com/CVE-2026-77710/ (Markdown: https://insights.sbomify.com/CVE-2026-77710/index.md)","id":"CVE-2026-77710","markdown":"https://insights.sbomify.com/CVE-2026-77710/index.md","name":"CVE-2026-77710","record":{"aliases":["GHSA-pqpx-w6cx-7q9c"],"analysis":{"component_type":"library","fix_type":"patch","impacts":["data_modify","security_bypass"],"network_reachable":"yes","non_default_config":false,"product_category":"MISP STIX library","requires_auth":"none","summary":"Attackers can inject unauthorized metadata into MISP attributes via crafted STIX documents, altering distribution and sharing policies.","user_interaction":"not_required","vuln_class":"other"},"analysis_generated_by":"qwen3.8-flash-next","assigner":"CIRCL","cpe":[],"cvss":{"score":6.9,"severity":"medium","source":"cna","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N","version":"4.0"},"cwes":[{"id":"CWE-20","name":"Improper Input Validation"}],"description":"A vulnerability in misp-stix could allow a crafted STIX document to influence security-sensitive MISP attribute metadata during import.\n\nThe STIX import logic automatically selected between the internal MISP parser and the external STIX parser based on metadata contained in the STIX document itself. For STIX2, the presence of MISP-specific tool labels could cause a document to be classified as originating from MISP; similarly, STIX1 relied on the document title. These classification indicators are fully controlled by the STIX producer and therefore cannot constitute a trusted indication of the document's origin. The accompanying fix explicitly notes that the parser choice was previously based solely on labels or header titles that any producer could write, and introduces an explicit classification parameter allowing callers to override this detection.\n\nWhen STIX2 content was handled as an internal MISP export, attributes contained in an x-misp-object were converted by copying the complete x_misp_attributes dictionary and passing it directly to misp_object.add_attribute(). Consequently, a crafted STIX bundle could supply fields that were not part of the expected STIX-to-MISP round-trip format, including security-sensitive properties such as distribution, sharing_group_id, tags, or other MISP attribute fields.\n\nAn attacker able to provide a STIX document for import could therefore spoof the markers used to identify MISP-generated content and inject additional attribute properties. This could alter the distribution, sharing restrictions, classification, or semantic metadata of imported attributes, potentially causing information to be shared contrary to the importing organization's policy or influencing downstream processing and automation based on attacker-controlled tags or metadata.\n\nThe vulnerability results from dynamically assigning externally supplied object properties without restricting them to an expected set of attributes, matching CWE-915. MITRE specifically describes this weakness as accepting externally influenced fields without controlling which object attributes may be modified and recommends an allow-list, which is the approach implemented by the patch. The parser-selection issue additionally corresponds to CWE-807, because an untrusted value was used to make a security-relevant trust/classification decision.\n\nThe attack is also consistent with CAPEC-153 (Input Data Manipulation), in which an attacker controls the structure or flags of supplied data so that the target selects a different processing path or interprets the content differently than intended.","ecosystems":[],"exploits":{"exploitdb":0,"first_seen":null,"github_poc":0,"max_poc_stars":null,"metasploit":0,"nuclei":0,"refs":[],"tier":"none_known"},"has_fix":false,"headline":"STIX2 Parser Confusion and Mass Assignment Allow Unauthorized MISP Attribute Metadata Injection in misp-stix library","id":"CVE-2026-77710","indexable":true,"kev":null,"kind":"cve","links":{"ecosystem":null,"product":null,"products":[],"type":"other","year":"2026"},"n_packages":0,"n_references":2,"next":{"headline":"Information disclosure in Eclipse Jetty","id":"CVE-2026-77711"},"packages":[],"prev":{"headline":"TLS Certificate Validation Disabled for Keycloak Connections in HAVELSAN's Liman Render Engine","id":"CVE-2026-77707"},"products":["misp-stix"],"published":"2026-08-21","related":[],"sources":[{"class":"attribution","licence":"CVE Terms of Use (MITRE)","name":"CVE List","prefix":"CVE"},{"class":"attribution","licence":"CWE Terms of Use","name":"CWE (MITRE)"},{"class":"attribution","licence":"FIRST CVSS licence","name":"CVSS (FIRST)"}],"ssvc":{"automatable":"yes","exploitation":"none","technical_impact":"partial"},"state":"PUBLISHED","updated":"2026-08-21","vendors":["MISP"]},"summary":"Attackers can inject unauthorized metadata into MISP attributes via crafted STIX documents, altering distribution and sharing policies.","url":"https://insights.sbomify.com/CVE-2026-77710/"}