DEV Community

CVE Reports
CVE Reports

Posted on Originally published at cvereports.com

CVE-2026-61807: CVE-2026-61807: Stored DOM-Based Cross-Site Scripting in Snipe-IT

#security #cve #cybersecurity

CVE-2026-61807: Stored DOM-Based Cross-Site Scripting in Snipe-IT

Vulnerability ID: CVE-2026-61807
CVSS Score: 6.3
Published: 2026-08-19

A Stored DOM-based Cross-Site Scripting (DOM XSS) vulnerability exists in Snipe-IT versions prior to 8.6.2. The vulnerability occurs when a stored manufacturer or supplier name is converted to CamelCase and rendered within the 'data-selected-count-id' attribute of a table. Client-side JavaScript retrieves this decoded attribute and performs unsafe string concatenation, passing it directly into jQuery's '.after()' method, enabling authenticated attackers to execute arbitrary JavaScript in the victim's session.

TL;DR

Authenticated low-privilege users can execute arbitrary JavaScript in the browsers of administrators by creating or renaming a manufacturer or supplier with a crafted malicious payload, exploiting unsafe client-side DOM construction via jQuery.

⚠️ Exploit Status: POC

Technical Details

  • CWE ID: CWE-79
  • Attack Vector: Network (AV:N)
  • CVSS v4.0 Score: 6.3
  • Exploit Status: Proof of Concept / Theoretical
  • CISA KEV Status: Not Listed
  • Impact: Stored DOM-Based Cross-Site Scripting (DOM XSS)

Affected Systems

  • Snipe-IT
  • Snipe-IT: < 8.6.2 (Fixed in: 8.6.2)

Code Analysis

Commit: d12ad3d

Fix commit addressing unsafe DOM element construction in bootstrap-table.blade.php

Vulnerable code concatenation in bootstrap-table.blade.php is replaced with safe programmatic jQuery element builders and document.createTextNode.
Enter fullscreen mode Exit fullscreen mode

Mitigation Strategies

  • Upgrade to Snipe-IT version 8.6.2 or higher.
  • Enable native Content Security Policy (CSP) headers in the .env file.
  • Restrict write access on manufacturer and supplier configuration views to trusted users.

Remediation Steps:

  1. Verify current Snipe-IT version.
  2. Backup application files and the SQL database.
  3. Execute composer update or pull the latest docker image for version 8.6.2.
  4. Ensure .env contains ENABLE_CSP=true.
  5. Validate that the manufacturer detail pages load correctly without errors.

References

Read the full report for CVE-2026-61807 on our website for more details including interactive diagrams and full exploit analysis.

Top comments (0)