Is there a patch available for CVE-2026-55464?

Yes, a patch is available for CVE-2026-55464. Update the affected software to the latest version immediately.

Snipe-IT CVE-2026-55464

Q: What is the CVSS score of CVE-2026-55464?

CVE-2026-55464 has a CVSS 4.0 base score of 4.8 (Medium). CVSS vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:A/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.2%.

EUVD-2026-42992 MEDIUM

Cross-site Scripting (XSS) (CWE-79)

2026-07-10 GitHub_M

GHSA-r52f-r9v5-66xr

XSS Snipe It Grokability

4.8

CVSS 4.0 · Vendor: GitHub_M

Severity by source

Vendor (GitHub_M) PRIMARY

4.8 MEDIUM

CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:A/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

vuln.today AI

5.4 MEDIUM

Network delivery, low complexity; PR:L for required assets.edit role; UI:R for mandatory victim click; S:C with C:L/I:L for session-level impact on victim.

3.1 AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N

4.0 AV:N/AC:L/AT:N/PR:L/UI:A/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N

Primary rating from Vendor (GitHub_M).

CVSS VectorVendor: GitHub_M

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

Scope

Lifecycle Timeline

Patch available

Jul 10, 2026 - 20:02 EUVD

Analysis Generated

Jul 10, 2026 - 19:31 vuln.today

DescriptionCVE.org

Snipe-IT is an IT asset/license management system. Prior to 8.6.2, CommonMark escapes raw HTML but does not sanitize javascript: URIs in Markdown hyperlinks, allowing a user with assets.edit permission to place a malicious link in a markdown-textarea custom field that executes arbitrary JavaScript when another user opens the asset detail page and clicks the link. This issue is fixed in version 8.6.2.

AnalysisAI

Stored cross-site scripting (XSS) in Snipe-IT before 8.6.2 allows a low-privileged user with the assets.edit permission to plant a malicious javascript: URI inside a Markdown hyperlink in a custom textarea field. When any other user opens the affected asset detail page and clicks the crafted link, arbitrary JavaScript executes in their browser session. No public exploit code or active exploitation has been identified at time of analysis, and the vendor has released a patch in v8.6.2.

Technical ContextAI

Snipe-IT (CPE: cpe:2.3:a:grokability:snipe-it) is a PHP-based IT asset and license management platform. It uses CommonMark to render Markdown in custom fields. CommonMark's default sanitization strips raw HTML tags, which prevents direct injection of <script> elements; however, it does not filter javascript: scheme URIs embedded in Markdown hyperlink syntax (e.g., [click me](javascript:alert(1))). This gap maps directly to CWE-79 (Improper Neutralization of Input During Web Page Generation / Cross-site Scripting), specifically the stored variant, because the malicious payload is persisted to the database alongside the asset record and rendered to every viewer of that asset's detail page. The vulnerability bypasses HTML-level sanitization by abusing a URL context rather than an HTML element context.

RemediationAI

Upgrade to Snipe-IT version 8.6.2 or later. The fix is documented in the GitHub security advisory at https://github.com/grokability/snipe-it/security/advisories/GHSA-r52f-r9v5-66xr and implemented in commit 006981cccffce1739e24d3b680b676f772f40e2d (https://github.com/grokability/snipe-it/commit/006981cccffce1739e24d3b680b676f772f40e2d). If immediate patching is not possible, restrict the assets.edit permission to only fully trusted users, as this is the sole prerequisite for placing the malicious payload. Additionally, deploy or tighten a Content Security Policy (CSP) header that blocks javascript: navigations (e.g., script-src 'self') - this provides defense-in-depth and mitigates the click-to-execute step, though it does not remove the stored payload. Note that restricting permissions may affect legitimate asset editing workflows.