Vulnerability · Published Jun 26, 2026 · Assigned by rapid7

CVE-2026-8661Server-Side Cross-Site Scripting and SSRF in Rapid7 InsightConnect Markdown to PDF Plugin

Medium 4.8

In plain English

A medium-severity cross-site scripting in InsightConnect Markdown Plugin from Rapid7. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.4% (higher than 32% of all known vulnerabilities).

Severity (CVSS 3.1)4.8Medium

Exploit odds (30 days)0.4%top 68.3% of all CVEs

Exploited in the wildNo reportsCISA SSVC: none

Attack toolingNoneno public tooling known

Official description

Server-Side Request Forgery in the markdown_to_pdf action of Rapid7 InsightConnect Markdown Plugin on Linux in versions prior to 4.0.2 allows remote attackers to make arbitrary outbound HTTP requests via unsanitized resource-loading HTML elements (img/src, CSS url(), @import) embedded in Markdown input. The initial fix in 4.0.0 disabled JavaScript but did not neutralize resource-loading vectors. Resolved in 4.0.2 by sanitizing HTML with an allowlist of tags, attributes, and URL schemes.

Affected products (as reported)

Vendor	Product	Versions
Rapid7	InsightConnect Markdown Plugin	0 – before 4.0.2

Weakness: CWE-79, CWE-918 · Vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:N

In plain English

Official description

Affected products (as reported)

References