GHSA-r52f-r9v5-66xr

Snipe-IT vulnerable to stored XSS via Markdown custom field

Source: GitHub Advisory Database (reviewed) Moderate CVE-2026-55464

Packages

Ecosystem	Package	Affected	Fixed in
Packagist	snipe/snipe-it	< 8.6.2	8.6.2

Details

As written in the advisory (Markdown source, shown as plain text).

### Impact CommonMark is configured with `html_input => 'escape'`, which blocks raw HTML injection. However, javascript: URIs in Markdown hyperlinks are not sanitized. A user with `assets.edit` permission can inject a malicious link into any markdown-textarea custom field. Any user who opens the asset detail page and clicks the link executes arbitrary JavaScript in their browser session.

References

External links from the advisory. They lead to third-party sites.

https://github.com/grokability/snipe-it/security/advisories/GHSA-r52f-r9v5-66xr web
https://nvd.nist.gov/vuln/detail/CVE-2026-55464 advisory
https://github.com/grokability/snipe-it/commit/006981cccffce1739e24d3b680b676f772f40e2d web
https://github.com/grokability/snipe-it package
https://github.com/grokability/snipe-it/releases/tag/v8.6.2 web