Junglewise Threat Intelligence

CVE-2026-61807: Snipe-IT stored DOM XSS via table selected-count IDs

CVE-2026-61807 · Severity: medium · CVSS 6.3 · Published 2026-08-19

Executive brief

Snipe-IT is an open-source IT asset management platform that tracks equipment and inventory. A stored cross-site scripting (XSS) vulnerability in the table component allows an attacker with the ability to create or modify supplier or manufacturer names to inject malicious JavaScript code. When an authenticated user views an affected detail page, the injected code executes in their browser, potentially allowing the attacker to steal session data, perform actions on behalf of the user, or access sensitive information.

Technical details

The vulnerability is a stored DOM-based XSS (CWE-79) in Snipe-IT's table component that affects manufacturer and supplier detail pages. The root cause is improper handling of user-supplied data: stored manufacturer or supplier names are embedded into a data-selected-count-id HTML attribute, then client-side JavaScript reads this attribute, URL-decodes it, uses it as a jQuery selector, and concatenates a substring directly into an HTML string passed to jQuery's .after() method. An attacker can inject a malicious payload (e.g., `x[foo=""><svg/onload=alert(1)>"]>`) as a manufacturer or supplier name in the database; when the victim views the affected page, the injected markup is inserted into the DOM and JavaScript executes. Exploitation requires that an attacker have the ability to create or modify supplier/manufacturer records and that an authenticated user view the detail page. The patch (commit d12ad3d) replaces the vulnerable string concatenation with document.getElementById() and DOM/jQuery element constructors, eliminating the injection vector. The issue is fixed in version 8.6.2 and later.

Affected products

  • Grokability Snipe-IT < 8.6.2

Timeline

  • 2026-06-24: disclosed: Advisory published by GitHub
  • 2026-06-24: patched: Patched in version 8.6.2
  • 2026-08-19: advisory: Added to GitHub Advisory Database

References

Related threats