CVE-2026-55464: Snipe-IT: Stored XSS via Markdown custom field
Impact CommonMark is configured with htmlinput => 'escape', which blocks raw HTML injection. However, javascript: URIs in Markdown hyperlinks are not sanitized. A user with assets.edit permission can inject a malicious link into any markdown-textarea custom field. Any user who opens the asset detail page and clicks the link executes arbitrary JavaScript in their browser session.
Other sources
Snipe-IT is an IT asset/license management system. Prior to 8.6.2, CommonMark escapes raw HTML but does not sanitize javascript: URIs in Markdown hyperlinks, allowing a user with assets.edit permission to place a malicious link in a markdown-textarea custom field that executes arbitrary JavaScript when another user opens the asset detail page and clicks the link. This issue is fixed in version 8.6.2.
— MITRE
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
composer/snipe/snipe-itto a version that resolves this vulnerability.Fixed in 8.6.2 - Upgrade
Upgrade
Snipe-ITto a version that resolves this vulnerability.Fixed in 8.6.2
Event History
Frequently Asked Questions
What is the severity of CVE-2026-55464?
CVE-2026-55464 has a risk rating of 33, indicating a moderate severity level.
How do I fix CVE-2026-55464?
To mitigate CVE-2026-55464, upgrade Snipe-IT to version 8.6.2 or later.
What type of vulnerability is CVE-2026-55464?
CVE-2026-55464 is classified as a stored Cross-Site Scripting (XSS) vulnerability.
Who is affected by CVE-2026-55464?
Users with assets.edit permission in Snipe-IT versions prior to 8.6.2 are affected by CVE-2026-55464.
What can an attacker do with CVE-2026-55464?
An attacker can inject malicious JavaScript through Markdown custom fields, potentially executing arbitrary code in the context of other users.