CVE-2026-55464 Snipe-IT: Stored XSS via Markdown custom field

Medium 4.8 Published 10 Jul 2026 Updated 13 Jul 2026

An attacker with edit permissions can inject malicious JavaScript via Markdown links in custom fields, executing code when other users view the asset.

Exploited in the wild: Not known
Login needed: Any signed-in user
Attackable: Over the internet
Victim action needed: A user has to click or open something
Fix: Available

What is CVE-2026-55464?

CVE-2026-55464 is a medium-severity cross-site scripting vulnerability in Snipeitapp Snipe-It, published on 10 Jul 2026. Any signed-in user can exploit it over the network, and only if a user opens a file or follows a link.

Official description

Snipe-IT is an IT asset/license management system. Prior to 8.6.2, CommonMark escapes raw HTML but does not sanitize javascript: URIs in Markdown hyperlinks, allowing a user with assets.edit permission to place a malicious link in a markdown-textarea custom field that executes arbitrary JavaScript when another user opens the asset detail page and clicks the link. This issue is fixed in version 8.6.2.

Weakness: CWE-79

Which versions are affected by CVE-2026-55464?

2 open source packages ship an affected version, including snipe/snipe-it. It affects 1 product.

Package	Affected	Fixed in
`snipe/snipe-it` Packagist	All versions	`8.6.2`
`snipe/snipe-it` Packagist	All versions	`8.6.2`

Products include Snipeitapp Snipe-It.

How do I fix CVE-2026-55464?

Upgrade snipe/snipe-it to 8.6.2 or later.

Escape output for the context it lands in and set a strict Content Security Policy. Upgrading the affected component is the real fix. More about Cross-site scripting.

Is CVE-2026-55464 being exploited?

There is no known exploitation of CVE-2026-55464 in the wild and no public exploit code.

All Snipeitapp Snipe-It vulnerabilities

Sources

Also known as GHSA-r52f-r9v5-66xr.