Sign in
Deutsch English Español Polski
Medium

Snipe-IT vulnerable to stored XSS via Markdown custom field

  • Disclosed: 28.08.2026
  • Updated: 11.10.2026 10:22

Impact

CommonMark is configured with html_input => 'escape', which blocks raw HTML injection. However, javascript: URIs in Markdown hyperlinks are not sanitized. A user with assets.edit permission can inject a malicious link into any markdown-textarea custom field. Any user who opens the asset detail page and clicks the link executes arbitrary JavaScript in their browser session.

Affected software

Click a technology to see all vulnerabilities affecting it.

PlatformPackageVulnerable versionsFixed in
Composer package snipe/snipe-it < 8.6.2 8.6.2

References

CVSS score 5.4/10
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N
Weakness (CWE)
CWE-79
Platform
Composer
Package
snipe/snipe-it
Disclosed
28.08.2026
Updated
11.10.2026 10:22

Sources and licenses

OSV / GitHub Advisory Database - GHSA-r52f-r9v5-66xr - CC BY 4.0

Vulnerability history: snipe/snipe-it

All published vulnerabilities of this package (Composer package), newest first. Shows whether this is a one-off slip or a package that needs watching.

All (81) in the archive
Total entries
81
First → latest
10.2021 09.2026
Without a fix
6
Exploited in attacks
0

Severity breakdown

  • Critical 1
  • High 23
  • Medium 53
  • Low 4

Disclosures per year

Severity:
  1. Snipe-IT: Stored XSS via Inline XML Rendering in the Uploaded Files API
    High · 8.7 CVE-2026-63498 < 8.7.0 8.7.0
  2. Snipe-IT: Stored XSS via Custom Field name in asset-list column headers
    High · 8.1 CVE-2026-62368 < 8.7.0 8.7.0
  3. Snipe-IT: 2FA bypass via the API token flow
    High CVE-2026-63493 < 8.7.0 8.7.0
  4. Snipe-IT has an Improper Privilege Management issue
    High · 6.5 CVE-2026-55843 < 8.6.0 8.6.0
  5. Snipe-IT vulnerable to cross-company asset maintenance re-parenting via API update
    High · 7.7 CVE-2026-55516 < 8.6.2 8.6.2
  6. Snipe-IT vulnerable to directory traversal in displaySig
    High CVE-2026-55474 < 8.5.0 8.5.0
  7. Snipe-IT vulnerable to stored XSS via Markdown custom field this entry
    Medium · 5.4 CVE-2026-55464 < 8.6.2 8.6.2
  8. Snipe-IT has an authorization bypass on bulk editing users
    High · 7.1 CVE-2026-55460 < 8.6.2 8.6.2
  9. Snipe-IT: Chained Information Disclosure and IDOR Leads to Full EULA File Takeover
    High CVE-2026-55694 < 8.6.3 8.6.3
  10. Snipe-IT: Tenant Isolation Bypass in FMCS Floater Mode
    High CVE-2026-55643 < 8.6.3 8.6.3
  11. Snipe-IT API Vulnerable to Cross-Tenant Accessory Injection
    High · 8.5 CVE-2026-54329 < 8.6.2 8.6.2
  12. Snipe-IT: Bulk editing users allowed `ldap_import` and `activated_in` bulk editing users
    High · 7.1 CVE-2026-48507 < 8.6.0 8.6.0
  13. Snipe-IT has insecure permissions in file uploads
    Critical · 9.8 CVE-2026-37709 < 8.4.1 8.4.1
  14. Snipe-IT has Privilege Escalation via API Permissions Assignment
    High · 8.8 CVE-2026-44832 < 8.4.1 8.4.1
  15. Snipe-IT has sensitive user attributes related to account privileges that are insufficiently protected against mass assignment
    High · 8.8 CVE-2025-15602 < 8.3.7 8.3.7
  16. Cross Site Scripting vulnerability in Snipe-IT
    High · 8.7 CVE-2024-51093 <= 7.0.13 no fix
  17. Snipe-IT remote code execution
    High · 7.2 CVE-2024-48987 < 7.0.10 7.0.10
  18. Snipe-IT allows users to promote or demote themselves or other users
    High · 8.1 CVE-2024-5685 < 6.4.2 6.4.2
  19. Cross-Site Request Forgery (CSRF) in snipe/snipe-it
    High · 8.8 CVE-2023-5511 < 6.2.3 6.2.3
  20. snipe-IT vulnerable to host header injection
    High · 8.8 CVE-2022-23064 >= 3.0-alpha, < 5.3.8 5.3.8
  21. Old sessions not blocked by login enable function in Snipe-IT
    High · 7.4 CVE-2022-1155 >= 6.0.0-RC-1, < 6.0.0-RC-6, < 5.4.2 6.0.0-RC-6, 5.4.2
  22. Improper Privilege Management in Snipe-IT
    High · 8.8 CVE-2022-0611 < 5.3.11 5.3.11
  23. snipe-it is vulnerable to Cross-Site Request Forgery (CSRF)
    High · 8.8 CVE-2021-4130 < 5.3.6 5.3.6
  24. Server-Side Request Forgery in snipe/snipe-it
    High · 7.2 CVE-2021-4075 < 6.0.0-GM 6.0.0-GM
  25. Cross-site Scripting in snipe/snipe-it
    High · 8.0 CVE-2021-3961 < 5.3.2 5.3.2

Know which vulnerabilities affect your application

With the DockRay integration and software inventory enabled, DockRay checks reported component versions against known vulnerabilities and notifies you about confirmed matches. Coverage depends on the supported technology and available advisory data.

Connect your application
DockRay newsletter

Application security in your inbox

Important vulnerabilities, actionable guidance and practical advice for your applications. Choose your technologies and follow what matters to your project.

  • A daily digest of new vulnerabilities, critical ones included.
  • Notifications about important updates.
  • Practical advice on application security and monitoring.

Leave empty to receive updates for every technology.

Privacy policy

Free to subscribe. Unsubscribe with one click in any email.