CVE-2026-55464: Snipe-IT: Stored XSS via Markdown custom field
Snipe-IT is an IT asset/license management system. Prior to 8.6.2, CommonMark escapes raw HTML but does not sanitize javascript: URIs in Markdown hyperlinks, allowing a user with assets.edit permission to place a malicious link in a markdown-textarea custom field that executes arbitrary JavaScript when another user opens the asset detail page and clicks the link. This issue is fixed in version 8.6.2.
Affected Software
Remediation
Event History
Frequently Asked Questions
What is the severity of CVE-2026-55464?
CVE-2026-55464 has a risk rating of 33, indicating a moderate severity level.
How do I fix CVE-2026-55464?
To mitigate CVE-2026-55464, upgrade Snipe-IT to version 8.6.2 or later.
What type of vulnerability is CVE-2026-55464?
CVE-2026-55464 is classified as a stored Cross-Site Scripting (XSS) vulnerability.
Who is affected by CVE-2026-55464?
Users with assets.edit permission in Snipe-IT versions prior to 8.6.2 are affected by CVE-2026-55464.
What can an attacker do with CVE-2026-55464?
An attacker can inject malicious JavaScript through Markdown custom fields, potentially executing arbitrary code in the context of other users.