CVE-2026-112290
Received Received - Intake

DOM-based XSS in Intelligence Community UI Kit ic-tree-item

Publication date: 2026-10-19

Last updated on: 2026-10-19

Assigner: VulnCheck

Description
Intelligence Community UI Kit @ukic/canary-web-components 3.0.0-canary.12 before 3.0.0-canary.48 contains a DOM-based cross-site scripting vulnerability in ic-tree-item that re-parses router-item slot text as HTML. When tree item truncation is enabled, attackers who influence a tree item label can have escaped markup decoded by truncateTreeItemLabel() and executed as JavaScript in visitors' browsers.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-10-19
Last Modified
2026-10-19
Generated
2026-10-19
AI Q&A
2026-10-19
EPSS Evaluated
N/A
NVD
CVE-2026-112290
EUVD
EUVD-2026-104283

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
MI6 Intelligence Community UI Kit canary web components 3.0.0-canary.12

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-79 The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This vulnerability is a DOM-based cross-site scripting (XSS) flaw in the Intelligence Community UI Kit's ic-tree-item component. It occurs when router-item slot text is re-parsed as HTML. If tree item truncation is enabled, attackers can manipulate a tree item label so that escaped markup is decoded by truncateTreeItemLabel() and executed as JavaScript in victims' browsers.

Detection Guidance

To detect this DOM-based XSS vulnerability in ic-tree-item, inspect web applications using the Intelligence Community UI Kit versions 3.0.0-canary.12 to 3.0.0-canary.48. Check for tree items with dynamic labels that may be truncated. Use browser developer tools to examine if router-item slot text is re-parsed as HTML and if truncateTreeItemLabel() decodes escaped markup.

Impact Analysis

Attackers could execute malicious scripts in your browser when visiting a page using the vulnerable component. This could lead to theft of session cookies, account takeover, or unauthorized actions on your behalf. Users with sensitive data exposure or those interacting with affected applications are at higher risk.

Compliance Impact

This XSS vulnerability could lead to unauthorized data access or modification, violating GDPR's integrity and confidentiality principles. For HIPAA, it may compromise protected health information integrity. Organizations must address this to maintain compliance with data protection requirements.

Mitigation Strategies

Immediately update the @ukic/canary-web-components library to version 3.0.0-canary.48 or later. Disable tree item truncation if not required. Sanitize user-controlled input in tree item labels to prevent malicious markup. Implement Content Security Policy (CSP) headers to mitigate XSS impact.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-112290. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart