CVE-2026-8661: Server-Side Cross-Site Scripting and SSRF in Rapid7 InsightConnect Markdown to PDF Plugin
Server-Side Cross-Site Scripting and Server-Side Request Forgery vulnerability in the markdowntopdf action of Rapid7 InsightConnect Markdown Plugin version 3.1.4 and earlier on Linux allows remote attackers to execute JavaScript server-side and make arbitrary outbound HTTP requests via crafted content embedded in Markdown input. The PDF rendering engine does not restrict script execution or outbound network access.
Other sources
Server-Side Request Forgery in the markdowntopdf action of Rapid7 InsightConnect Markdown Plugin on Linux in versions prior to 4.0.2 allows remote attackers to make arbitrary outbound HTTP requests via unsanitized resource-loading HTML elements (img/src, CSS url(), @import) embedded in Markdown input. The initial fix in 4.0.0 disabled JavaScript but did not neutralize resource-loading vectors. Resolved in 4.0.2 by sanitizing HTML with an allowlist of tags, attributes, and URL schemes.
— MITRE
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
Rapid7 InsightConnect Markdown to PDF Pluginto a version that resolves this vulnerability.Fixed in 4.0.2
Event History
Frequently Asked Questions
What is the severity of CVE-2026-8661?
CVE-2026-8661 has a medium severity rating of 4.8.
How do I fix CVE-2026-8661?
To fix CVE-2026-8661, upgrade the Rapid7 InsightConnect Markdown to PDF Plugin to version 3.1.5 or later.
What type of vulnerability is CVE-2026-8661?
CVE-2026-8661 is a vulnerability that involves Server-Side Cross-Site Scripting (XSS) and Server-Side Request Forgery (SSRF).
What versions of Rapid7 InsightConnect are affected by CVE-2026-8661?
CVE-2026-8661 affects Rapid7 InsightConnect Markdown to PDF Plugin versions 3.1.4 and earlier.
Can CVE-2026-8661 allow remote attackers to execute JavaScript?
Yes, CVE-2026-8661 allows remote attackers to execute JavaScript server-side through the markdown_to_pdf action.