CVE-2026-86751

Snipe-IT versions before 8.7.0 fail to properly sanitize markdown image syntax in note fields. An authenticated attacker can submit markdown image syntax in checkout acceptance notes that survive HTML escaping, get expanded by the CommonMark parser , and are then resolved by laravel-mail-auto-emb...