Back to overview

CVE-2026-8661

MEDIUM
4.8
CVSS 3.1
Description
Server-Side Cross-Site Scripting and Server-Side Request Forgery vulnerability in the markdown_to_pdf action of Rapid7 InsightConnect Markdown Plugin version 3.1.4 and earlier on Linux allows remote attackers to execute JavaScript server-side and make arbitrary outbound HTTP requests via crafted content embedded in Markdown input. The PDF rendering engine does not restrict script execution or outbound network access.

Metadata

CVE ID
CVE-2026-8661
State
PUBLISHED
Assigner
rapid7
Reserved
2026-05-15 06:29 UTC
Published
2026-06-26 01:59 UTC
Last updated
2026-06-26 12:24 UTC
Primary CWE
CWE-79
CWE-79 Improper Neutralization of Input During Web Page Gene…
Vendor / Product
Rapid7 / InsightConnect Markdown Plugin
Sources
cve.org  ·  NVD

Severity & Metrics

4.8 MEDIUM CVSS 3.1
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:N
SSVC — CISA Coordinator
Exploitation
none
Automatable
no
Tech. Impact
partial
Affected products (1)
VendorProductPlatformVersions
Rapid7 InsightConnect Markdown Plugin Linux 0 < 4.0.0, 4.0.0
Weakness (CWE)
CWESourceDescription
CWE-79 cna CWE-79 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
CWE-918 cna CWE-918 Server-Side Request Forgery (SSRF)
CVSS scores (1)
ScoreSeverityVersionSourceVector
4.8 MEDIUM 3.1 cna CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:N
References (2)
Back to overview