In short
- CVE-2026-55464 is a MEDIUM (CVSS 5.4) vulnerability affecting snipe/snipe-it, snipe-it (snipeitapp).
- Chance of exploitation in the next 30 days (EPSS): 0.29%, higher than 22.2% of all vulnerabilities.
- Fix: update to 8.6.2 or later.
Description
Impact
CommonMark is configured with html_input => 'escape', which blocks raw HTML injection. However, javascript: URIs in Markdown hyperlinks are not sanitized. A user with assets.edit permission can inject a malicious link into any markdown-textarea custom field. Any user who opens the asset detail page and clicks the link executes arbitrary JavaScript in their browser session.
NVD description
Snipe-IT is an IT asset/license management system. Prior to 8.6.2, CommonMark escapes raw HTML but does not sanitize javascript: URIs in Markdown hyperlinks, allowing a user with assets.edit permission to place a malicious link in a markdown-textarea custom field that executes arbitrary JavaScript when another user opens the asset detail page and clicks the link. This issue is fixed in version 8.6.2.
More vulnerabilities in snipe/snipe-it
See all →Running one of these products? Scan your site to see whether it exposes a vulnerable version.
Scan my site free