# CVE-2026-86738: Snipe-IT CSS injection in custom CSS field

Source: https://junglewise.ai/threats/cve-2026-86738-snipe-it-css-injection-in-custom-css-field  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-09-08. Updated: 2026-09-26  
License: CC BY 4.0 with a link back

CVE-2026-86738 · Severity: high · CVSS 8.7 · Published 2026-09-08

Snipe-IT is an open-source asset management system used by organizations to track IT inventory. A flaw in how the application sanitizes user-provided CSS allows a superuser to plant malicious CSS payloads that steal CSRF tokens from other superusers, leading to account takeover of any peer administrator account.

Technologies: [Snipeitapp Snipe-It](https://junglewise.ai/threats/technologies/snipe-it). Vendors: [Snipeitapp](https://junglewise.ai/threats/vendors/snipeitapp).

## Quick answers

**Is CVE-2026-86738 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-86738 being exploited in the wild.

**How severe is CVE-2026-86738?** High severity, with a CVSS score of 8.7, published 8 September 2026.

**Which products and versions are affected?** Snipe-IT Snipe-IT 3.0 through 8.6.3.

**Is there a fix for CVE-2026-86738?** A patch was published on 2026-08-03: Fix committed to repository (v8.7.0) Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-86738 attacked?** It is attacked over the network, in a web application.

**Am I affected by CVE-2026-86738?** Check whether you run Snipeitapp Snipe-It. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

The vulnerability is a CSS injection flaw in the custom CSS field (POST /admin/branding) caused by incomplete sanitization in Setting::show_custom_css(). The sanitization logic applies HTML encoding then selectively reverses it for greater-than and double-quote characters, leaving CSS syntax fully intact. An attacker can inject @import directives or url() references to attacker-controlled external stylesheets. Because the sanitized CSS is emitted in a global <style> block on every authenticated page load, a superuser can execute CSS-based data exfiltration via attribute-selector rules (e.g., input[name="_token"][value^="a"]) to steal CSRF tokens character by character from other superusers. Successful token exfiltration enables account takeover via forged state-changing requests. The vulnerability affects all versions through 8.6.3 and is fixed in 8.7.0.

## Affected products

- Snipe-IT Snipe-IT 3.0 through 8.6.3

## Timeline

- 2026-09-08: disclosed: CVE-2026-86738 published
- 2026-08-03: patched: Fix committed to repository (v8.7.0)
- 2026-08-24: other: GHSA-pvcw-mp8q-mj39 advisory published

## References

- [https://github.com/grokability/snipe-it/commit/d26d71688359707f3b257fc04fe6c3e5a17405f9](https://github.com/grokability/snipe-it/commit/d26d71688359707f3b257fc04fe6c3e5a17405f9)
- [https://github.com/grokability/snipe-it/security/advisories/GHSA-pvcw-mp8q-mj39](https://github.com/grokability/snipe-it/security/advisories/GHSA-pvcw-mp8q-mj39)

## Related threats

- [Snipe-IT broken access control in Asset Model file attachments](https://junglewise.ai/threats/cve-2026-86774-snipe-it-broken-access-control-in-asset-model-file-attachments)
- [Snipe-IT broken access control in Predefined Kit endpoints](https://junglewise.ai/threats/cve-2026-86773-snipe-it-broken-access-control-in-predefined-kit-endpoints)
- [Snipe-IT stored cross-site scripting in department names](https://junglewise.ai/threats/cve-2026-86772-snipe-it-stored-cross-site-scripting-in-department-names)
- [Snipe-IT acceptance PDF server-side request forgery via unescaped employee_num](https://junglewise.ai/threats/cve-2026-86771-snipe-it-acceptance-pdf-server-side-request-forgery-via-unescaped)
- [Snipe-IT authentication bypass in SAML username collation](https://junglewise.ai/threats/cve-2026-86770-snipe-it-authentication-bypass-in-saml-username-collation)