Is CVE-2026-8661 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-8661 being exploited in the wild.

How severe is CVE-2026-8661?

Medium severity, with a CVSS score of 4.8, published 26 June 2026.

Which products and versions are affected?

Rapid7 InsightConnect Markdown Plugin <= 3.1.4.

Is there a fix for CVE-2026-8661?

A patch was published on 2026-02-12: Pull request merged to disable JS execution and bump SDK Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is CVE-2026-8661 attacked?

It is attacked over the network, in a software library.

Am I affected by CVE-2026-8661?

Check whether you run Rapid7 InsightConnect Markdown Plugin at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-8661: Rapid7 InsightConnect Markdown Plugin XSS and SSRF in markdown_to_pdf

Q: Is there a fix for CVE-2026-8661?

A patch was published on 2026-02-12: Pull request merged to disable JS execution and bump SDK Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

Q: How is CVE-2026-8661 attacked?

It is attacked over the network, in a software library.

Q: Am I affected by CVE-2026-8661?

Check whether you run Rapid7 InsightConnect Markdown Plugin at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-8661 · Severity: medium · CVSS 4.8 · Published 2026-06-26

The Rapid7 InsightConnect Markdown Plugin, which is used to convert text between different formats like HTML and PDF, contains a security flaw in its PDF conversion feature. An attacker can use specially crafted content to force the server to execute malicious scripts or make unauthorized network requests to other internal systems. This could lead to the exposure of sensitive internal data or unauthorized access to private network resources.

Vendors: Rapid7.

Quick answers

Is CVE-2026-8661 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-8661 being exploited in the wild.
How severe is CVE-2026-8661?: Medium severity, with a CVSS score of 4.8, published 26 June 2026.
Which products and versions are affected?: Rapid7 InsightConnect Markdown Plugin <= 3.1.4.
Is there a fix for CVE-2026-8661?: A patch was published on 2026-02-12: Pull request merged to disable JS execution and bump SDK Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-8661 attacked?: It is attacked over the network, in a software library.
Am I affected by CVE-2026-8661?: Check whether you run Rapid7 InsightConnect Markdown Plugin at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

A vulnerability exists in the markdown_to_pdf action of the Rapid7 InsightConnect Markdown Plugin (version 3.1.4 and earlier) due to insufficient restrictions in the underlying PDF rendering engine. Remote attackers can provide crafted Markdown input that triggers the execution of arbitrary JavaScript on the server or initiates unauthorized outbound HTTP requests (SSRF). The root cause is the failure to disable script execution and restrict network access during the Pandoc-based conversion process. This allows for potential data exfiltration from the local environment or internal network scanning. The issue is addressed in version 4.0.0 by disabling JavaScript execution.

Affected products

Rapid7 InsightConnect Markdown Plugin <= 3.1.4

Timeline

2026-02-12: patched: Pull request merged to disable JS execution and bump SDK
2026-06-26: disclosed: CVE published to NVD

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.