Stored XSS via Malicious Markdown Link in Snipe-IT

Compliance Impact

The vulnerability CVE-2026-55464 is a stored Cross-Site Scripting (XSS) issue that allows an attacker with assets.edit permission to inject malicious JavaScript into a Markdown custom field. This can lead to arbitrary code execution in the browser of users who view the affected asset detail page and click the malicious link.

Such a vulnerability can potentially impact compliance with common standards and regulations like GDPR and HIPAA because it may lead to unauthorized access or exposure of sensitive information through client-side attacks. XSS vulnerabilities can be exploited to steal session tokens, user credentials, or other sensitive data, which could result in data breaches or unauthorized data processing.

Therefore, organizations using affected versions of Snipe-IT prior to 8.6.2 might face increased risk of non-compliance with data protection regulations that require safeguarding personal and sensitive data against unauthorized access and ensuring system security.

Useful 0 Not Useful 0

Executive Summary

CVE-2026-55464 is a stored Cross-Site Scripting (XSS) vulnerability in the Snipe-IT asset management system versions prior to 8.6.2.

The issue arises because CommonMark escapes raw HTML but does not sanitize javascript: URIs in Markdown hyperlinks.

An attacker with assets.edit permission can inject a malicious JavaScript URI into a Markdown custom field.

When another user views the asset detail page and clicks the malicious link, arbitrary JavaScript executes in their browser session.

This vulnerability was fixed in version 8.6.2.

Useful 0 Not Useful 0

Impact Analysis

This vulnerability allows an attacker with limited permissions (assets.edit) to execute arbitrary JavaScript in the browser of users who view the affected asset detail page and click the malicious link.

The impact includes potential session hijacking, unauthorized actions performed on behalf of the user, or exposure of sensitive information accessible in the user's browser context.

Because the attack requires user interaction (clicking the link), the risk is moderate but still significant in environments where users have sensitive roles or data.

Useful 0 Not Useful 0

Detection Guidance

This vulnerability involves a stored Cross-Site Scripting (XSS) issue in the Snipe-IT system where a user with assets.edit permission can inject malicious javascript: URIs into Markdown custom fields.

To detect this vulnerability on your system, you should check if your Snipe-IT installation is running a version prior to 8.6.2.

Additionally, you can audit the Markdown custom fields for any suspicious links containing javascript: URIs.

There are no specific commands provided in the resources, but you might consider querying the database for Markdown fields containing 'javascript:' links, for example using SQL commands like:

• SELECT * FROM custom_fields WHERE field_value LIKE '%javascript:%';

Also, reviewing user permissions to identify users with assets.edit permission who might have added such links can help.

Useful 0 Not Useful 0

Mitigation Strategies

The immediate mitigation step is to upgrade your Snipe-IT installation to version 8.6.2 or later, where this vulnerability has been fixed.

The fix involves disabling unsafe links in Markdown rendering by setting the configuration option 'allow_unsafe_links' to false.

Until you can upgrade, restrict or review the assets.edit permission to trusted users only to reduce the risk of malicious link injection.

Additionally, audit and remove any suspicious javascript: links from Markdown custom fields if found.

Useful 0 Not Useful 0