CVE-2026-55464: Snipeitapp Snipe-it XSS Vulnerability

CVE-2026-55464 Overview

Snipe-IT is an open-source IT asset and license management system used by organizations to track hardware, software, and licenses. CVE-2026-55464 is a stored cross-site scripting (XSS) vulnerability [CWE-79] affecting Snipe-IT versions prior to 8.6.2. The CommonMark markdown renderer escapes raw HTML but fails to sanitize javascript: URIs in markdown hyperlinks. An authenticated user with assets.edit permission can inject a malicious link into a markdown-textarea custom field. When another user views the asset detail page and clicks the link, arbitrary JavaScript executes in the victim's browser session. The issue is fixed in version 8.6.2.

Critical Impact
Authenticated attackers with asset edit permissions can execute arbitrary JavaScript in the browsers of other Snipe-IT users, enabling session hijacking, credential theft, or unauthorized actions on behalf of higher-privileged accounts.

Affected Products

Snipe-IT versions prior to 8.6.2
Snipeitapp Snipe-IT asset management platform
Deployments using markdown-textarea custom fields on asset records

Discovery Timeline

2026-07-10 - CVE-2026-55464 published to NVD
2026-07-13 - Last updated in NVD database

Technical Details for CVE-2026-55464

Vulnerability Analysis

The vulnerability resides in the markdown rendering helper used to display custom field content on asset detail pages. Snipe-IT uses the Laravel Str::markdown() and Str::inlineMarkdown() helpers, which wrap the CommonMark library. The application enabled html_input => 'escape' to neutralize raw HTML tags but did not set allow_unsafe_links => false. CommonMark treats this as an opt-in and continues to render hyperlinks with javascript:, data:, and vbscript: schemes. An attacker with assets.edit permission can save markdown such as [Click here](javascript:alert(document.cookie)) into a custom field. When a reviewer opens the asset and clicks the link, the payload executes under the Snipe-IT origin, exposing session cookies, CSRF tokens, and API access.

Root Cause

The root cause is missing configuration of the allow_unsafe_links option in the CommonMark environment. HTML escaping alone does not prevent malicious URI schemes inside legitimate markdown link syntax. The renderer produces an <a href="javascript:..."> element that browsers execute on click.

Attack Vector

Exploitation requires an authenticated account with assets.edit permission and user interaction from the victim. The attacker plants the payload in a custom field, then relies on another user clicking the crafted link within the asset detail view.

php

// Patch: app/Helpers/Helper.php
// Convert newlines to CommonMark hard breaks for inline rendering
$text = preg_replace('/(?<! {2})\n/', "  \n", $text);

- return Str::inlineMarkdown($text, ['html_input' => 'escape']);
+ return Str::inlineMarkdown($text, ['html_input' => 'escape', 'allow_unsafe_links' => false]);

$html = trim(Str::markdown($text, [
    'html_input' => 'escape',
+   'allow_unsafe_links' => false,
    'renderer' => ['soft_break' => "<br>\n"],
]));

Source: GitHub Commit 006981c. The patch adds allow_unsafe_links => false to both the inline and block markdown renderers, instructing CommonMark to strip links with dangerous URI schemes.

Detection Methods for CVE-2026-55464

Indicators of Compromise

Custom field values containing markdown link syntax with javascript:, data:, or vbscript: URI schemes
Rendered <a> tags on asset detail pages whose href attribute begins with a non-http(s) scheme
Audit log entries showing modification of markdown-textarea custom fields by users with assets.edit permission followed by asset views from higher-privileged accounts

Detection Strategies

Query the Snipe-IT database for custom field values matching the regex \]\(\s*(javascript|data|vbscript): to identify stored payloads
Inspect web server access logs for outbound requests to attacker-controlled hosts originating from asset detail page views
Review browser Content Security Policy (CSP) violation reports for inline script executions on /hardware/* routes

Monitoring Recommendations

Enable and centralize Snipe-IT activity logs to track custom field edits and correlate with subsequent views
Alert on any authenticated session performing unusual API calls immediately after loading an asset detail page
Monitor for privilege escalation patterns where low-privileged editors modify assets viewed by administrators

How to Mitigate CVE-2026-55464

Immediate Actions Required

Upgrade Snipe-IT to version 8.6.2 or later without delay
Audit existing custom field data for markdown links containing non-HTTP URI schemes and remove any malicious entries
Review the assets.edit role assignments and revoke the permission from accounts that do not require it

Patch Information

The fix is available in Snipe-IT 8.6.2. See the GitHub Security Advisory GHSA-r52f-r9v5-66xr and the GitHub Release v8.6.2 notes. The corrective commit adds allow_unsafe_links => false to the CommonMark renderer configuration in app/Helpers/Helper.php.

Workarounds

If immediate patching is not possible, restrict assets.edit permission to trusted administrators only
Deploy a strict Content Security Policy that disallows inline script execution and javascript: URIs
Temporarily disable or remove markdown-textarea custom fields until the upgrade is applied

bash

# Upgrade Snipe-IT to the patched release
cd /var/www/snipe-it
git fetch --tags
git checkout v8.6.2
composer install --no-dev --prefer-source
php artisan migrate --force
php artisan config:clear && php artisan cache:clear