Snipe-IT: Stored DOM XSS via table selected-count IDs
Impact
The table component derives data-selected-count-id from the component $name value. On manufacturer and supplier detail pages, stored manufacturer or supplier names are passed into affected table components as that name value. The client-side JavaScript later reads the browser-decoded data-selected-count-id, uses it as a selector, and concatenates countId.substring(1) directly into an HTML string passed to jQuery .after().
Affected commit:
b224cc636c6780386e3f73f03d1171f52ab4c37a
Example payload for a manufacturer or supplier name:
x[foo="><svg/onload=alert(1)>"]>
The issue appears to involve the following flow:
Stored supplier/manufacturer name -> table component data-selected-count-id -> browser decodes the attribute -> JavaScript reads countId -> countId is used as a selector -> countId.substring(1) is concatenated into HTML -> jQuery .after() inserts attacker-controlled markup -> JavaScript executes in the victim's browser
Potential impact includes arbitrary JavaScript execution in the browser of an authenticated Snipe-IT user who views the affected supplier or manufacturer detail page. If the victim has elevated privileges, this may allow access to data or actions available to that user's session.
Patches
Patched in https://github.com/grokability/snipe-it/commit/d12ad3d53869443b96b663ba3ce2673ef343da71
Affected software
Click a technology to see all vulnerabilities affecting it.
| Platform | Package | Vulnerable versions | Fixed in |
|---|---|---|---|
| Composer package | snipe/snipe-it | < 8.6.2 | 8.6.2 |
References
- CVSS vector
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:P/VC:L/VI:L/VA:N/SC:H/SI:H/SA:N- Weakness (CWE)
CWE-79- Platform
- Composer
- Package
snipe/snipe-it- Disclosed
- 19.08.2026
- Updated
- 11.10.2026 10:22
Sources and licenses
OSV / GitHub Advisory Database - GHSA-c8qc-wf67-342w - CC BY 4.0
Vulnerability history: snipe/snipe-it
All published vulnerabilities of this package (Composer package), newest first. Shows whether this is a one-off slip or a package that needs watching.
- Total entries
- 81
- First → latest
- 10.2021 09.2026
- Without a fix
- 6
- Exploited in attacks
- 0
Severity breakdown
- Critical 1
- High 23
- Medium 53
- Low 4
Disclosures per year
- 2021: 10
- 2022: 20
- 2023: 2
- 2024: 3
- 2025: 6
- 2026: 40
-
Snipe-IT: Stored DOM XSS via table selected-count IDs this entry
Know which vulnerabilities affect your application
With the DockRay integration and software inventory enabled, DockRay checks reported component versions against known vulnerabilities and notifies you about confirmed matches. Coverage depends on the supported technology and available advisory data.