PT-2026-52661 · Rapid7 · Insightconnect Markdown Plugin

Publicado 2026-06-26 · Atualizado 2026-06-26 · CVE-2026-8661

Mitre

CVSS v3.1

4.8

Média

Vetor base

AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:N

Server-Side Cross-Site Scripting and Server-Side Request Forgery vulnerability in the markdown to pdf action of Rapid7 InsightConnect Markdown Plugin version 3.1.4 and earlier on Linux allows remote attackers to execute JavaScript server-side and make arbitrary outbound HTTP requests via crafted content embedded in Markdown input. The PDF rendering engine does not restrict script execution or outbound network access.

Correção

SSRF

XSS

Enumeração de Fraquezas

CWE-918

CWE-79

Identificadores relacionados

CVE-2026-8661

Produtos afetados

Insightconnect Markdown Plugin

Referências · 3

• https://nvd.nist.gov/vuln/detail/CVE-2026-8661 · Nota de Segurança
• https://github.com/rapid7/insightconnect-plugins/blob/master/plugins/markdown/help.md · Aviso do Fabricante
• https://github.com/rapid7/insightconnect-plugins/pull/3721 · Correção