CVE-2026-55464Medium· 5.4▾ SunlitSnipe-IT vulnerable to stored XSS via Markdown custom field
▾ Sunlit zone — Low / medium · no exploitation signal
impact 29.7 · likelihood 0.1 · exploitation 0
Need a working PoC? Pro members can cast a request and our team develops one — it lands right here.
Exploit-prediction probability, daily snapshots since Aug 28.
Disclosure to exploitation, from the record and what we observed since indexing it.
Disclosed via GHSA
0.3%
CommonMark is configured with html_input => 'escape', which blocks raw HTML injection. However, javascript: URIs in Markdown hyperlinks are not sanitized. A user with assets.edit permission can inject a malicious link into any markdown-textarea custom field. Any user who opens the asset detail page and clicks the link executes arbitrary JavaScript in their browser session.
snipe/snipe-it <= 8.6.1Upgrade to a patched release:
snipe/snipe-it 8.6.2Connected by shared product, vendor, weakness, or advisory.
CVE-2026-61807MediumSnipe-IT is an IT asset/license management system
CVE-2026-55460High· 7.1Snipe-IT has an authorization bypass on bulk editing users
CVE-2026-55472Medium· 4.3Snipe-IT's API Location Creation Bypasses FMCS Parent-Child Company Boundary Validation
CVE-2026-55516High· 7.7Snipe-IT vulnerable to cross-company asset maintenance re-parenting via API update
CVE-2026-55843High· 6.5Snipe-IT has an Improper Privilege Management issue
CVE-2026-55476MediumSnipe-IT Vulnerable to Unauthorized Asset Request Cancellation via Unguarded cancel_by_admin Parameter