MEDIUM5.4

GHSA-r52f-r9v5-66xr

Snipe-IT vulnerable to stored XSS via Markdown custom field

Quick fix

GHSA-r52f-r9v5-66xr — snipe/snipe-it: upgrade to the fixed version with the command below.

composer require snipe/snipe-it:^8.6.2

Details

### Impact CommonMark is configured with `html_input => 'escape'`, which blocks raw HTML injection. However, javascript: URIs in Markdown hyperlinks are not sanitized. A user with `assets.edit` permission can inject a malicious link into any markdown-textarea custom field. Any user who opens the asset detail page and clicks the link executes arbitrary JavaScript in their browser session.

Are you affected?

Enter the version of the package you're using.

Affected packages

Packagist/snipe/snipe-it

Introduced in: 0Fixed in: 8.6.2

Fixcomposer require snipe/snipe-it:^8.6.2

References

https://github.com/grokability/snipe-it/security/advisories/GHSA-r52f-r9v5-66xr[WEB]
https://nvd.nist.gov/vuln/detail/CVE-2026-55464[ADVISORY]
https://github.com/grokability/snipe-it/commit/006981cccffce1739e24d3b680b676f772f40e2d[WEB]
https://github.com/grokability/snipe-it[PACKAGE]
https://github.com/grokability/snipe-it/releases/tag/v8.6.2[WEB]