Summary
Snipe-IT: Stored DOM XSS via table selected-count IDs
Impact
The table component derives data-selected-count-id from the component $name value. On manufacturer and supplier detail pages, stored manufacturer or supplier names are passed into affected table components as that name value. The client-side JavaScript later reads the browser-decoded data-selected-count-id, uses it as a selector, and concatenates countId.substring(1) directly into an HTML string passed to jQuery .after().
Affected commit:
b224cc636c6780386e3f73f03d1171f52ab4c37a
Example payload for a manufacturer or supplier name:x[foo="><svg/onload=alert(1)>"]>
The issue appears to involve the following flow:
Stored supplier/manufacturer name
-> table component data-selected-count-id
-> browser decodes the attribute
-> JavaScript reads countId
-> countId is used as a selector
-> countId.substring(1) is concatenated into HTML
-> jQuery .after() inserts attacker-controlled markup
-> JavaScript executes in the victim's browser
Potential impact includes arbitrary JavaScript execution in the browser of an authenticated Snipe-IT user who views the affected supplier or manufacturer detail page. If the victim has elevated privileges, this may allow access to data or actions available to that user's session.
Untrusted input is rendered as active markup in a victim's browser, which can run script in their session. Typical impact: session or credential theft, and actions taken as the user.
Affected versions
Security releases
Kodem intelligence
Severity tells you how bad this could be in the worst case. It does not tell you whether you are exposed. Exploitability and impact are functions of runtime truth: whether the vulnerable code is present, reachable, and actually executes in your application. A vulnerable package can sit in your dependency tree and never run.
Kodem, an Intelligent Application Security platform, uses runtime intelligence to reveal which vulnerabilities actually execute in production, so teams prioritize the ones that genuinely matter. Kodem's runtime-powered SCA identifies whether this CVE is reachable in your applications.
Already deployed Kodem?
See it in your environmentNew to Kodem? Get a demo →Remediation advice
Frequently Asked Questions
- What is CVE-2026-61807? CVE-2026-61807 is a medium-severity cross-site scripting (XSS) vulnerability in snipe/snipe-it (composer), affecting versions < 8.6.2. It is fixed in 8.6.2. Untrusted input is rendered as active markup in a victim's browser, which can run script in their session.
- Which versions of snipe/snipe-it are affected by CVE-2026-61807? snipe/snipe-it (composer) versions < 8.6.2 is affected.
- Is there a fix for CVE-2026-61807? Yes. CVE-2026-61807 is fixed in 8.6.2. Upgrade to this version or later.
- Is CVE-2026-61807 exploitable, and should I be worried? Whether CVE-2026-61807 is exploitable in your environment depends on whether the vulnerable code is present and reachable. A CVSS score is a worst-case rating; it does not account for your specific deployment, configuration, or usage patterns. Kodem, an Intelligent Application Security platform, uses runtime intelligence to show which vulnerabilities actually execute in production, so you can focus on the ones that represent real risk. Get a demo
- What actually determines whether CVE-2026-61807 is exploitable, and how bad it is? Exploitability and impact are not fixed properties of a CVE. They depend on runtime truth: whether the vulnerable code is present, reachable, and actually executes in your application. A high CVSS score on a dependency that never runs is not the same as real risk. Kodem, an Intelligent Application Security platform, uses runtime intelligence to reveal which vulnerabilities actually execute in production, so teams prioritize the ones that genuinely matter.
- How do I fix CVE-2026-61807? Upgrade
snipe/snipe-itto 8.6.2 or later.