Quick answers
- Is CVE-2026-86738 exploited in the wild?
- No. Junglewise Threat Intelligence has no report of CVE-2026-86738 being exploited in the wild.
- How severe is CVE-2026-86738?
- High severity, with a CVSS score of 8.7, published 8 September 2026.
- Which products and versions are affected?
- Snipe-IT Snipe-IT 3.0 through 8.6.3.
- Is there a fix for CVE-2026-86738?
- A patch was published on 2026-08-03: Fix committed to repository (v8.7.0) Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
- How is CVE-2026-86738 attacked?
- It is attacked over the network, in a web application.
- Am I affected by CVE-2026-86738?
- Check whether you run Snipeitapp Snipe-It. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.
Technical details
The vulnerability is a CSS injection flaw in the custom CSS field (POST /admin/branding) caused by incomplete sanitization in Setting::show_custom_css(). The sanitization logic applies HTML encoding then selectively reverses it for greater-than and double-quote characters, leaving CSS syntax fully intact. An attacker can inject @import directives or url() references to attacker-controlled external stylesheets. Because the sanitized CSS is emitted in a global <style> block on every authenticated page load, a superuser can execute CSS-based data exfiltration via attribute-selector rules (e.g., input[name="_token"][value^="a"]) to steal CSRF tokens character by character from other superusers. Successful token exfiltration enables account takeover via forged state-changing requests. The vulnerability affects all versions through 8.6.3 and is fixed in 8.7.0.
Affected products
- Snipe-IT Snipe-IT 3.0 through 8.6.3
Timeline
- 2026-09-08: disclosed: CVE-2026-86738 published
- 2026-08-03: patched: Fix committed to repository (v8.7.0)
- 2026-08-24: other: GHSA-pvcw-mp8q-mj39 advisory published