CVE-2026-61807: Snipe-IT Stored XSS Vulnerability

CVE-2026-61807 Overview

CVE-2026-61807 is a stored cross-site scripting (XSS) vulnerability in Snipe-IT, an open-source IT asset and license management system. Versions prior to 8.6.2 fail to safely handle manufacturer and supplier names rendered through the shared Blade table partial. A crafted name passed as the table component $name becomes the data-selected-count-id attribute in resources/views/partials/bootstrap-table.blade.php. Client-side code decodes the value, concatenates it into an HTML string, and passes it to jQuery .after(), executing attacker-controlled script when an authenticated user views the affected detail page. The issue is fixed in version 8.6.2 [CWE-79].

Critical Impact
Authenticated attackers can store JavaScript in manufacturer or supplier names that executes in the browser of any user viewing the corresponding detail page, exposing session data and actions.

Affected Products

Snipe-IT versions prior to 8.6.2
resources/views/partials/bootstrap-table.blade.php shared table partial
Manufacturer detail page and supplier detail page

Discovery Timeline

2026-08-19 - CVE-2026-61807 published to NVD
2026-08-19 - Last updated in NVD database

Technical Details for CVE-2026-61807

Vulnerability Analysis

The vulnerability resides in the updateSelectedCount(table) function inside the bootstrap-table Blade partial. The function reads the selected-count-id data attribute using jQuery's .data() accessor. jQuery decodes HTML entities in data attributes before returning them to JavaScript, so any stored user input in the underlying $name value returns as raw characters. The decoded countId is then treated as a jQuery selector and its substring(1) result is concatenated into an HTML string handed to .after(). A manufacturer or supplier name containing markup such as <img src=x onerror=...> becomes live DOM when the detail page renders.

Root Cause

The root cause is unsafe treatment of attribute-derived, attacker-controlled data as HTML. The Blade template writes $name into data-selected-count-id without a channel-appropriate encoding contract. Downstream JavaScript then compounds the issue by using jQuery HTML-string APIs (.after()) instead of DOM APIs that treat values as text.

Attack Vector

An authenticated user with permission to create or edit manufacturers or suppliers stores a payload in the entity name. When any authenticated user subsequently visits the affected detail page, the payload is decoded from the data attribute and injected into the page. The exploit executes in the victim session context, enabling data theft, forced actions, or credential exposure available to that role.

php

// Patch: switch from jQuery selector/HTML concatenation to DOM APIs
function updateSelectedCount(table) {
    var countId = $(table).data('selected-count-id');
    if (!countId) return;
    var rawCountId = countId.charAt(0) === '#' ? countId.substring(1) : countId;
    if (!rawCountId) return;
    var el = document.getElementById(rawCountId);
    if (!el) return;
    var count = $(table).bootstrapTable('getSelections').length;
    $(el).find('.badge').text(count);
    if (count > 0) {
        $(el).show();
    } else {
        $(el).hide();
    }
}

Source: GitHub Commit d12ad3d

Detection Methods for CVE-2026-61807

Indicators of Compromise

Manufacturer or supplier records containing HTML tags, event handlers (onerror=, onload=), or <script> fragments in the name field.
Unexpected outbound requests initiated from browser sessions after visiting /manufacturers/{id} or /suppliers/{id} pages.
Audit log entries showing manufacturer or supplier create/update actions immediately preceded by low-privilege account activity.

Detection Strategies

Query the Snipe-IT database for manufacturers.name and suppliers.name values matching regex patterns such as <[a-zA-Z/] or containing javascript:.
Review web server access logs for POST requests to /manufacturers or /suppliers endpoints whose form bodies contain encoded angle brackets or event-handler substrings.
Correlate authenticated session cookies used to create the tainted records with subsequent viewer sessions to identify potential victims.

Monitoring Recommendations

Enable and centrally forward Snipe-IT application and web server logs for continuous review of asset metadata changes.
Add Content Security Policy (CSP) reporting to capture inline script violations on manufacturer and supplier detail pages.
Alert on any modification to the manufacturers or suppliers tables that introduces characters outside the expected alphanumeric and punctuation set.

How to Mitigate CVE-2026-61807

Immediate Actions Required

Upgrade Snipe-IT to version 8.6.2 or later without delay.
Audit existing manufacturer and supplier records and remove or sanitize any names containing HTML or script fragments.
Rotate session tokens for administrative accounts that may have viewed a tainted detail page since the vulnerable code was deployed.

Patch Information

The fix is delivered in Snipe-IT v8.6.2. Commit d12ad3d replaces jQuery selector parsing and HTML string concatenation in updateSelectedCount with document.getElementById and DOM/jQuery element constructors so that decoded attribute values are treated as plain text. Refer to the GitHub Security Advisory GHSA-c8qc-wf67-342w and the Snipe-IT v8.6.2 release notes for full details.

Workarounds

Restrict the roles able to create or edit manufacturers and suppliers to a small set of trusted administrators until the patch is applied.
Deploy a Content Security Policy that disallows inline script execution to blunt payload delivery.
Place a web application firewall rule in front of Snipe-IT that blocks HTML tags and event-handler attributes in the name fields of manufacturer and supplier endpoints.

bash

# Upgrade Snipe-IT via git to the patched release
cd /var/www/snipe-it
git fetch --tags
git checkout v8.6.2
php artisan migrate --force
php artisan config:clear && php artisan cache:clear