Server-side Cross‑Site Scripting (CWE‑79) and Server‑Side Request Forgery (CWE‑918) are present in the markdown_to_pdf action of Rapid7 InsightConnect Markdown Plugin version 3.1.4 and earlier on Linux. The vulnerability allows a remote attacker to inject arbitrary JavaScript that is executed directly by the PDF rendering engine and to cause the server to make outbound HTTP requests to any target. This combination can compromise the confidentiality, integrity, and availability of the system by enabling remote code execution and the ability to forward requests to internal or external services.

Rapid7 InsightConnect Markdown Plugin, version 3.1.4 and earlier, available on Linux operating systems.

The CVSS score of 4.8 indicates a moderate severity. The EPSS score is not available, and the vulnerability is not in CISA’s KEV catalog, so there is no documented exploitation to date. The likely attack vector is through the markdown_to_pdf action, which can be triggered via the web UI or API by providing crafted Markdown content. Successful exploitation requires the attacker to reach the plugin action and supply input containing malicious JavaScript or crafted URLs, after which the server will execute the script and/or make outbound HTTP requests.