CVE-2026-61807: Snipe-IT: Stored DOM XSS via table selected-count IDs
Impact The table component derives data-selected-count-id from the component $name value. On manufacturer and supplier detail pages, stored manufacturer or supplier names are passed into affected table components as that name value. The client-side JavaScript later reads the browser-decoded data-selected-count-id, uses it as a selector, and concatenates countId.substring(1) directly into an HTML string passed to jQuery .after().
Affected commit:
b224cc636c6780386e3f73f03d1171f52ab4c37a
Example payload for a manufacturer or supplier name: x[foo="><svg/onload=alert(1)>"]>
The issue appears to involve the following flow:
Stored supplier/manufacturer name -> table component data-selected-count-id -> browser decodes the attribute -> JavaScript reads countId -> countId is used as a selector -> countId.substring(1) is concatenated into HTML -> jQuery .after() inserts attacker-controlled markup -> JavaScript executes in the victim's browser
Potential impact includes arbitrary JavaScript execution in the browser of an authenticated Snipe-IT user who views the affected supplier or manufacturer detail page. If the victim has elevated privileges, this may allow access to data or actions available to that user's session.
Patches Patched in https://github.com/grokability/snipe-it/commit/d12ad3d53869443b96b663ba3ce2673ef343da71
Other sources
Snipe-IT is an IT asset/license management system. Prior to 8.6.2, a stored manufacturer or supplier name passed as the table component $name becomes data-selected-count-id in resources/views/partials/bootstrap-table.blade.php. Client-side code reads the browser-decoded countId, uses it as a selector, concatenates countId.substring(1) into an HTML string, and passes the string to jQuery .after(). A crafted name can therefore execute JavaScript when an authenticated user views the manufacturer detail page or supplier detail page, potentially exposing data or actions available to that session. This issue is fixed in version 8.6.2.
— MITRE
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
composer/snipe/snipe-itto a version that resolves this vulnerability.Fixed in 8.6.2 - Upgrade
Upgrade
Snipe-ITto a version that resolves this vulnerability.Fixed in 8.6.2Patch d12ad3d53869443b96b663ba3ce2673ef343da71 - Compensating control
After upgrading, review/clean any stored supplier/manufacturer names containing HTML/JS payload patterns similar to x[foo="/><svg/onload=alert(1)>" ]> or other content that could previously have been stored and later rendered by the affected manufacturer/supplier detail pages.
Event History
Frequently Asked Questions
Who can trigger the vulnerable rendering path?
An attacker needs to be able to store a crafted manufacturer or supplier name. The payload executes when an authenticated user views the corresponding manufacturer or supplier detail page.
Which versions are affected?
Versions prior to 8.6.2 are affected. The issue is fixed in Snipe-IT 8.6.2.
What is the impact if exploitation succeeds?
The crafted name can execute JavaScript in the authenticated viewer's browser. This may expose data or perform actions available to that user's session.
How can I identify potentially affected records?
Review stored manufacturer and supplier names, particularly records created or modified by untrusted users, for suspicious crafted values. The vulnerable paths are the manufacturer and supplier detail pages.