Server‑Side Request Forgery exists in the markdown_to_pdf action of the Rapid7 InsightConnect Markdown Plugin. Unsanitized resource‑loading HTML elements – such as img/src, CSS url(), and @import – can be embedded in Markdown input. When supplied to the action, the plugin processes the content and performs arbitrary outbound HTTP requests to the specified locations, enabling a remote attacker to direct traffic from the host to any network target. A prior patch in version 4.0.0 disabled client‑side JavaScript but did not eliminate the resource‑loading vectors; the issue was fully mitigated in version 4.0.2 through sanitization of HTML with an allowlist of tags, attributes, and URL schemes.

The vulnerability impacts the Rapid7 InsightConnect Markdown Plugin, all releases older than 4.0.2, when running on Linux operating systems. Only versions prior to 4.0.2 contain the flaw; newer releases incorporate the sanitization fix.

The CVSS base score is 4.8, indicating moderate severity. The EPSS score is less than 1 % and the vulnerability is not listed in the CISA KEV catalog, suggesting no known public exploitation to date. The likely attack path requires an adversary to reach the markdown_to_pdf action via the plugin’s web UI or API and supply crafted Markdown containing malicious resource‑loading elements. Upon successful exploitation, the host system will perform outbound HTTP requests to arbitrary destinations.