PT-2026-52661 · Rapid7 · Insightconnect Markdown Plugin

Published 2026-06-26 · Updated 2026-06-26 · CVE-2026-8661

Positive Technologies (AI Summary)

CVSS v3.1

4.8

Medium

Base vector

AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:N

Name of the Vulnerable Software and Affected Versions Rapid7 InsightConnect Markdown Plugin versions prior to 3.1.5

Description Server-Side Cross-Site Scripting (XSS) and Server-Side Request Forgery (SSRF) exist in the markdown to pdf action. These issues occur because the PDF rendering engine fails to restrict script execution and outbound network access, allowing remote attackers to execute JavaScript on the server and initiate arbitrary outbound HTTP requests through specially crafted content embedded in Markdown input.

Recommendations Update Rapid7 InsightConnect Markdown Plugin to version 3.1.5 or later. As a temporary mitigation, restrict the use of the markdown to pdf action.

Fix

SSRF

XSS

Weakness Enumeration

CWE-918

CWE-79

Related Identifiers

CVE-2026-8661

Affected Products

Insightconnect Markdown Plugin

References · 4

• https://github.com/rapid7/insightconnect-plugins/pull/3721 · Patch
• https://github.com/rapid7/insightconnect-plugins/blob/master/plugins/markdown/help.md · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2026-8661 · Security Note
• https://twitter.com/VulmonFeeds/status/2070373110142873662 · Twitter Post