CVE-2026-55464 is a cross-site scripting vulnerability in the Snipe-IT IT asset/license management system. The issue arises because CommonMark escapes raw HTML but does not sanitize javascript: URIs in Markdown hyperlinks. This allows an attacker with assets.edit permission to embed a malicious link in a markdown-textarea custom field. When another user views the asset detail page and clicks the link, arbitrary JavaScript executes. The vulnerability affects all versions prior to 8.6.2 and is resolved in version 8.6.2.

An attacker with assets.edit permission can inject malicious JavaScript code via a specially crafted markdown hyperlink. This code executes in the context of users who view the asset detail page and click the link, potentially leading to session hijacking, data theft, or other client-side attacks. The CVSS score is 4.8 (medium severity), reflecting the need for user interaction and limited privileges required for exploitation.

Upgrade Snipe-IT to version 8.6.2 or later, where this vulnerability is fixed. No other official remediation or temporary fixes are indicated. Users should apply this update promptly to prevent exploitation.