What is the CVSS score of CVE-2026-8661?

CVE-2026-8661 has a CVSS 3.1 base score of 4.8 (Medium). CVSS vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:N. EPSS exploitation probability: 0.3%.

Is there a patch available for CVE-2026-8661?

Yes, a patch is available for CVE-2026-8661. Update the affected software to the latest version immediately.

InsightConnect Markdown Plugin CVE-2026-8661

EUVD-2026-39616 MEDIUM

Cross-site Scripting (XSS) (CWE-79)

2026-06-26 rapid7

GHSA-6r62-qf74-xpgg

XSS SSRF Insightconnect Markdown Plugin Rapid7

4.8

CVSS 3.1 · Vendor: rapid7

Severity by source

Vendor (rapid7) PRIMARY

4.8 MEDIUM

AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:N

vuln.today AI

4.8 MEDIUM

Network-reachable PDF rendering action; high complexity from non-trivial payload requirements; no privileges or user interaction needed; limited to confidentiality and integrity impacts.

3.1 AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:N

4.0 AV:N/AC:H/AT:N/PR:N/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N

Primary rating from Vendor (rapid7).

CVSS VectorVendor: rapid7

Attack Vector

Network

Attack Complexity

High

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

Low

Integrity

Low

Availability

None

Lifecycle Timeline

Source Code Evidence Fetched

Jun 26, 2026 - 02:34 vuln.today

Analysis Generated

Jun 26, 2026 - 02:34 vuln.today

CVE Published

Jun 26, 2026 - 01:59 cve.org

MEDIUM 4.8

DescriptionCVE.org

Server-Side Cross-Site Scripting and Server-Side Request Forgery vulnerability in the markdown_to_pdf action of Rapid7 InsightConnect Markdown Plugin version 3.1.4 and earlier on Linux allows remote attackers to execute JavaScript server-side and make arbitrary outbound HTTP requests via crafted content embedded in Markdown input. The PDF rendering engine does not restrict script execution or outbound network access.

AnalysisAI

Server-side JavaScript execution and outbound HTTP request capabilities in Rapid7 InsightConnect Markdown Plugin versions 3.1.4 and earlier allow remote attackers to execute arbitrary scripts and make unauthorized HTTP requests through malicious content embedded in Markdown input to the markdown_to_pdf action. The PDF rendering engine lacks sufficient restrictions on script execution and network access. Patched version 4.0.0 is available from the vendor.

Technical ContextAI

The vulnerability resides in the markdown_to_pdf action, which leverages wkhtmltopdf (a WebKit-based HTML-to-PDF converter) for rendering Markdown content. The underlying issue stems from improper sandboxing of the rendering environment, allowing malicious JavaScript embedded in or referenced by Markdown to execute in the server context. This represents a variant of unsafe PDF rendering implementations (CWE-79 extends to SSRF through HTML/CSS resource references). The affected plugin runs in a containerized InsightConnect environment but lacks input validation and render-time restrictions on external resources and script execution.

RemediationAI

Upgrade Rapid7 InsightConnect Markdown Plugin to version 4.0.0 or later. The patched version is available via GitHub PR #3721 at https://github.com/rapid7/insightconnect-plugins/pull/3721 and updates the SDK container base and build pipeline to enforce safer rendering constraints. For organizations unable to patch immediately, restrict markdown_to_pdf action execution to trusted internal sources through workflow-level access controls within InsightConnect; this eliminates remote attack surface but may impact automation flexibility. Monitor markdown input sources-if external or user-supplied markdown must be processed, implement strict input validation and consider deploying action execution in ephemeral containers with network egress restrictions.