CVE-2026-8661 Server-Side Cross-Site Scripting and SSRF in Rapid7 InsightConnect Markdown to PDF Plugin
Remote attackers can trigger Server-Side Request Forgery and XSS via unsanitized Markdown input in the Rapid7 InsightConnect Markdown to PDF plugin.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2026-8661?
CVE-2026-8661 is a medium-severity server-side request forgery vulnerability in Rapid7 InsightConnect Markdown Plugin, published on 26 Jun 2026. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
Server-Side Request Forgery in the markdown_to_pdf action of Rapid7 InsightConnect Markdown Plugin on Linux in versions prior to 4.0.2 allows remote attackers to make arbitrary outbound HTTP requests via unsanitized resource-loading HTML elements (img/src, CSS url(), @import) embedded in Markdown input. The initial fix in 4.0.0 disabled JavaScript but did not neutralize resource-loading vectors. Resolved in 4.0.2 by sanitizing HTML with an allowlist of tags, attributes, and URL schemes.
Which versions are affected by CVE-2026-8661?
How do I fix CVE-2026-8661?
No fix has been published for CVE-2026-8661 yet. Limit exposure of the affected software until one is available.
Upgrade, and send outbound requests through an allow-list that blocks internal addresses. More about Server-side request forgery.
Is CVE-2026-8661 being exploited?
There is no known exploitation of CVE-2026-8661 in the wild and no public exploit code.
Sources
Also known as GHSA-6r62-qf74-xpgg.