CVE catalog

CVE-2026-55464

Snipe-IT is an IT asset/license management system. Prior to 8.6.2, CommonMark escapes raw HTML but does not sanitize javascript: URIs in Markdown hyperlinks, allowing a user with assets.edit permissio

[CVE catalog]

Severity
Medium · CVSS 5.4CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N
Published
Source
[NVD] · [CVE record]
EPSS
0.29% · Oct 25, 2026

Snipe-IT is an IT asset/license management system. Prior to 8.6.2, CommonMark escapes raw HTML but does not sanitize javascript: URIs in Markdown hyperlinks, allowing a user with assets.edit permission to place a malicious link in a markdown-textarea custom field that executes arbitrary JavaScript when another user opens the asset detail page and clicks the link. This issue is fixed in version 8.6.2.

Vulnerable and fixed packages

Distribution-reported package versions and fixes. These do not depend on matching against the OpenFactory package catalog.

DistributionPackageReleaseVersionStatus
Cpesnipe-itNot reported8.6.2fixed
Composersnipe/snipe-itNot reported8.6.2fixed
Cpesnipe-itNot reported8.6.2fixed

Fixed-version evidence

DistributionPackageTypeReleaseFixed versionUrgencyOriginBugs
Cpesnipe-itcpeNot reported8.6.2Not reportedNot reportedNot reported
Composersnipe/snipe-itcomposerNot reported8.6.2Not reportedGHSA-R52F-R9V5-66XRNot reported
Cpesnipe-itcpeNot reported8.6.2Not reportedNVD-CVE-2026-55464Not reported

OpenFactory catalog packages

No matching packages in this catalog.

Observed:

References

[CERT-Bund public advisories] · [FIRST EPSS] · [GitHub Advisory Database] · [National Vulnerability Database (NVD)]