Snipe-IT is an IT asset/license management system. Prior to 8.6.2, CommonMark escapes raw HTML but does not sanitize javascript: URIs in Markdown hyperlinks, allowing a user with assets.edit permission to place a malicious link in a markdown-textarea custom field that executes arbitrary JavaScript when another user opens the asset detail page and clicks the link. This issue is fixed in version 8.6.2.
Fix
Patch, vendor advisory and mitigation references on NVD 2
- https://github.com/grokability/snipe-it/commit/006981cccffce1739e24d3b680b676f772f40e2d Patch
- https://github.com/grokability/snipe-it/security/advisories/GHSA-r52f-r9v5-66xr Patch, Vendor Advisory
Every line above is quoted from NVD, CISA, Microsoft, the vendor's own advisory or DISA; nothing is generated.
Change history 1
- First seenCVSS 4.8 · snipeitappNVD modified 2026-10-25 15:10
Affected (CPE criteria) 1
cpe:2.3:a:snipeitapp:snipe-it:*:*:*:*:*:*:*:*