CVE-2026-77710: CWE-20 Improper Input Validation in MISP misp-stix

The vulnerability in misp-stix stems from improper input validation (CWE-20) and untrusted classification decisions (CWE-807) during STIX document import. The import logic automatically selects between internal and external parsers based on metadata labels or titles controlled by the STIX producer, which is untrusted. When STIX2 content is misclassified as internal MISP export, attributes from x-misp-object are copied wholesale, allowing crafted STIX bundles to inject unauthorized fields like distribution, sharing_group_id, and tags. This can alter attribute metadata and sharing policies, potentially violating organizational security controls. The vulnerability matches CWE-915 due to accepting externally influenced fields without restricting object attributes. The patch introduces an explicit classification parameter and an allow-list to restrict attribute injection.

An attacker able to supply a crafted STIX document for import can manipulate MISP attribute metadata, including distribution and sharing restrictions, potentially causing sensitive information to be shared improperly or influencing automated processing based on attacker-controlled tags. This could lead to policy violations and incorrect handling of threat intelligence data within the importing organization. There is no indication of privilege escalation or remote code execution. No known exploits in the wild have been reported.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. The described fix introduces an explicit classification parameter to override parser selection based on untrusted metadata and implements an allow-list to restrict accepted attribute fields during import. Until an official patch is available, organizations should carefully validate STIX documents before import and consider restricting import sources to trusted entities to mitigate risk.