CVE-2026-61807
Received Received - Intake

Stored XSS in Snipe-IT Asset Management System

Publication date: 2026-08-19

Last updated on: 2026-08-19

Assigner: GitHub, Inc.

Description
Snipe-IT is an IT asset/license management system. Prior to 8.6.2, a stored manufacturer or supplier name passed as the table component $name becomes data-selected-count-id in resources/views/partials/bootstrap-table.blade.php. Client-side code reads the browser-decoded countId, uses it as a selector, concatenates countId.substring(1) into an HTML string, and passes the string to jQuery .after(). A crafted name can therefore execute JavaScript when an authenticated user views the manufacturer detail page or supplier detail page, potentially exposing data or actions available to that session. This issue is fixed in version 8.6.2.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-08-19
Last Modified
2026-08-19
Generated
2026-08-19
AI Q&A
2026-08-19
EPSS Evaluated
N/A
NVD
CVE-2026-61807
EUVD
EUVD-2026-62626

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
snipe-it snipe-it 8.6.2

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-79 The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

CVE-2026-61807 is a stored DOM-based Cross-Site Scripting (XSS) vulnerability in Snipe-IT versions 8.6.1 and earlier. It occurs when a malicious manufacturer or supplier name is stored and later rendered in a table component. The name is used to create a data attribute that, when decoded by the browser, allows JavaScript execution via jQuery's .after() method. This enables attackers to inject arbitrary scripts into pages viewed by authenticated users.

Detection Guidance

Check Snipe-IT version with: grep -r "version" /path/to/snipe-it/config/app.php. If version is 8.6.1 or earlier, the system is vulnerable. Inspect manufacturer/supplier names in the database for suspicious JavaScript payloads like <script>alert(1)</script>.

Impact Analysis

If exploited, this vulnerability could allow an attacker to execute arbitrary JavaScript in the context of a victim's browser session. This may lead to session hijacking, unauthorized data access, or actions performed on behalf of the victim if they have elevated privileges. Users viewing affected manufacturer or supplier detail pages are at risk.

Compliance Impact

This vulnerability could lead to unauthorized data exposure or modification, violating confidentiality requirements under GDPR and HIPAA. If exploited, it may result in data breaches, triggering mandatory breach notifications and potential fines under these regulations.

Mitigation Strategies

Upgrade Snipe-IT to version 8.6.2 or later immediately. Review and sanitize all manufacturer and supplier names in the database to remove any malicious payloads. Restrict access to authenticated pages until the upgrade is complete.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-61807. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart