CVE-2026-55464

5.4 Moyenne

Publiée le 10/07/2026 à 21:17 · Modifiée le 13/07/2026 à 18:16 · Analysée par le NVD · Source : security-advisories@github.com

Description

Snipe-IT is an IT asset/license management system. Prior to 8.6.2, CommonMark escapes raw HTML but does not sanitize javascript: URIs in Markdown hyperlinks, allowing a user with assets.edit permission to place a malicious link in a markdown-textarea custom field that executes arbitrary JavaScript when another user opens the asset detail page and clicks the link. This issue is fixed in version 8.6.2.

Traduire en français

Produits concernés

Scores CVSS

Version	Score	Source	Vecteur
4.0	4.8 Moyenne	security-advisories@github.com	`CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:A/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X`
3.1	5.4 Moyenne	nvd@nist.gov (NVD)	`CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N`

Faiblesses (CWE)

CWE-79

Références

https://github.com/grokability/snipe-it/commit/006981cccffce1739e24d3b680b676f772f40e2d Patch
https://github.com/grokability/snipe-it/releases/tag/v8.6.2 Release Notes
https://github.com/grokability/snipe-it/security/advisories/GHSA-r52f-r9v5-66xr PatchVendor Advisory

CVE-2026-55464

Description

Produits concernés

Scores CVSS

Faiblesses (CWE)

Références

Ailleurs