CVE-2026-55464

תיאור (מקור, אנגלית)

Snipe-IT is an IT asset/license management system. Prior to 8.6.2, CommonMark escapes raw HTML but does not sanitize javascript: URIs in Markdown hyperlinks, allowing a user with assets.edit permission to place a malicious link in a markdown-textarea custom field that executes arbitrary JavaScript when another user opens the asset detail page and clicks the link. This issue is fixed in version 8.6.2.

מדדים

CVSS 3.1

5.4 (MEDIUM) מקור הציון: NVD CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N

CVSS 4.0

4.8 (MEDIUM) מקור הציון: CNA CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:A/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

EPSS — סבירות ניצול

0% (אחוזון 000) נכון ל-17/8/2026

CWE

CWE-79

מוצרים מושפעים

snipeitapp: snipe-it

קישורים

• https://github.com/grokability/snipe-it/security/advisories/GHSA-r52f-r9v5-66xr PatchVendor Advisory
• https://github.com/grokability/snipe-it/commit/006981cccffce1739e24d3b680b676f‮… Patch
• https://github.com/grokability/snipe-it/releases/tag/v8.6.2 Release Notes