CVE-2026-55464: Snipe-IT vulnerable to stored XSS via Markdown custom field

August 28, 2026

CommonMark is configured with html_input => 'escape', which blocks raw HTML injection. However, javascript: URIs in Markdown hyperlinks are not sanitized. A user with assets.edit permission can inject a malicious link into any markdown-textarea custom field. Any user who opens the asset detail page and clicks the link executes arbitrary JavaScript in their browser session.

References

github.com/advisories/GHSA-r52f-r9v5-66xr
github.com/grokability/snipe-it/commit/006981cccffce1739e24d3b680b676f772f40e2d
github.com/grokability/snipe-it/releases/tag/v8.6.2
github.com/grokability/snipe-it/security/advisories/GHSA-r52f-r9v5-66xr
nvd.nist.gov/vuln/detail/CVE-2026-55464

Code Behaviors & Features

Detect and mitigate CVE-2026-55464 with GitLab Dependency Scanning

Secure your software supply chain by verifying that all open source dependencies used in your projects contain no disclosed vulnerabilities. Dependency Scanning using SBOM also detects vulnerabilities from proprietary advisories that this site does not include. Learn more about Dependency Scanning using SBOM →