CVE-2026-61807: Snipe-IT stored DOM XSS via table selected-count IDs

CVE-2026-61807 · Severity: medium · CVSS 6.1 · Published 2026-08-19

Snipe-IT is an open-source IT asset management platform that tracks equipment and inventory. A stored cross-site scripting (XSS) vulnerability in the table component allows an attacker with the ability to create or modify supplier or manufacturer names to inject malicious JavaScript code. When an authenticated user views an affected detail page, the injected code executes in their browser, potentially allowing the attacker to steal session data, perform actions on behalf of the user, or access sensitive information.

Technologies: snipe/snipe-it (Packagist), Snipeitapp Snipe-It. Vendors: Packagist, Snipeitapp.

Quick answers

Is CVE-2026-61807 exploited in the wild?
No. Junglewise Threat Intelligence has no report of CVE-2026-61807 being exploited in the wild.
How severe is CVE-2026-61807?
Medium severity, with a CVSS score of 6.1, published 19 August 2026.
Which products and versions are affected?
snipe/snipe-it (Packagist) < 8.6.2, ECOSYSTEM:introduced=0,fixed=8.6.2.
Is there a fix for CVE-2026-61807?
Yes. snipe/snipe-it (Packagist): upgrade to 8.6.2 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-61807 attacked?
It is attacked over the network, in a web application.
Am I affected by CVE-2026-61807?
Check whether you run snipe/snipe-it (Packagist) or Snipeitapp Snipe-It at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

  • snipe/snipe-it (Packagist): upgrade to 8.6.2 or later
    composer require snipe/snipe-it:^8.6.2

Technical details

The vulnerability is a stored DOM-based XSS (CWE-79) in Snipe-IT's table component that affects manufacturer and supplier detail pages. The root cause is improper handling of user-supplied data: stored manufacturer or supplier names are embedded into a data-selected-count-id HTML attribute, then client-side JavaScript reads this attribute, URL-decodes it, uses it as a jQuery selector, and concatenates a substring directly into an HTML string passed to jQuery's .after() method. An attacker can inject a malicious payload (e.g., `x[foo=""><svg/onload=alert(1)>"]>`) as a manufacturer or supplier name in the database; when the victim views the affected page, the injected markup is inserted into the DOM and JavaScript executes. Exploitation requires that an attacker have the ability to create or modify supplier/manufacturer records and that an authenticated user view the detail page. The patch (commit d12ad3d) replaces the vulnerable string concatenation with document.getElementById() and DOM/jQuery element constructors, eliminating the injection vector. The issue is fixed in version 8.6.2 and later.

Affected products

  • Grokability Snipe-IT < 8.6.2

Identifiers

  • CVE-2026-61807
  • GHSA-c8qc-wf67-342w

Timeline

  • 2026-06-24: disclosed: Advisory published by GitHub
  • 2026-06-24: patched: Patched in version 8.6.2
  • 2026-08-19: advisory: Added to GitHub Advisory Database

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.