CVE-2026-112290: MI6 @ukic/canary-web-components 3.0.0-canary.12 before 3.0.0-canary.48 DOM XSS via ic-tree-item
Intelligence Community UI Kit @ukic/canary-web-components 3.0.0-canary.12 before 3.0.0-canary.48 contains a DOM-based cross-site scripting vulnerability in ic-tree-item that re-parses router-item slot text as HTML. When tree item truncation is enabled, attackers who influence a tree item label can have escaped markup decoded by truncateTreeItemLabel() and executed as JavaScript in visitors' browsers.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
@ukic/canary-web-componentsto a version that resolves this vulnerability.Fixed in 3.0.0-canary.48
Event History
Frequently Asked Questions
Which deployments are exposed to this issue?
Deployments using @ukic/canary-web-components versions from 3.0.0-canary.12 up to, but not including, 3.0.0-canary.48 are affected when they use ic-tree-item with tree item truncation enabled.
What would an attacker need to exploit it?
An attacker needs a way to influence a tree item label and must induce a visitor to view the affected tree item. The vulnerable truncation path re-parses escaped markup in the router-item slot text as HTML, allowing JavaScript execution in the visitor's browser.
What should teams do if they cannot patch immediately?
Disable tree item truncation where possible and prevent untrusted data from being used as tree item labels. Treat labels supplied by users or external systems as potentially malicious until the component can be updated to 3.0.0-canary.48 or later.