The vulnerability CVE-2026-8661 affects the markdown_to_pdf action of the Rapid7 InsightConnect Markdown Plugin on Linux, allowing remote attackers to make arbitrary outbound HTTP requests through unsanitized resource-loading HTML elements such as img/src, CSS url(), and @import embedded in Markdown input. The initial fix in version 4.0.0 disabled JavaScript but did not address these resource-loading vectors. The vulnerability was fully resolved in version 4.0.2 by implementing HTML sanitization with an allowlist of tags, attributes, and URL schemes to prevent SSRF attacks.

An attacker can exploit this vulnerability to cause the server to make arbitrary outbound HTTP requests, potentially leading to information disclosure or interaction with internal systems not otherwise accessible. The CVSS score of 4.8 reflects a medium severity impact with low confidentiality and integrity impact and no availability impact.

A fix is available in version 4.0.2 of the Rapid7 InsightConnect Markdown Plugin, which sanitizes HTML input to prevent SSRF via resource-loading elements. Users should upgrade to version 4.0.2 or later to remediate this vulnerability. No official patch or remediation level is explicitly stated in the advisory, but the vendor’s versioning indicates the issue is resolved in 4.0.2. Until upgraded, users should avoid processing untrusted Markdown input with vulnerable versions.