GHSA-r42m-953q-6vjx

Snipe-IT has Stored XSS via Component Checkout Notes (v8.4.0)

En bref

Publiée: 2026-05-08 22:23 UTC
Mise à jour: 2026-09-10 03:50 UTC
CVE: CVE-2026-44831
CVSS_V3: CVSS:3.1/AV:A/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N

Description

### Impact Users with component view access could be impacted by an unescaped `notes` column. ### Patches This was patched in https://github.com/grokability/snipe-it/commit/28f493d84d057895fbb93b6570e7393a2c2fa438, and is fixed in v8.4.1 or greater. ### Workarounds None.

Paquets affectés

Paquet	Versions
Packagist · snipe/snipe-it	introduced 0, fixed 8.4.1

Références

https://github.com/grokability/snipe-it/security/advisories/GHSA-r42m-953q-6vjx WEB
https://nvd.nist.gov/vuln/detail/CVE-2026-44831 ADVISORY
https://github.com/grokability/snipe-it/commit/28f493d84d057895fbb93b6570e7393a2c2fa438 WEB
https://github.com/grokability/snipe-it PACKAGE

Sources

Source	Licence
OSV.dev	CC-BY 4.0 — GitHub Advisory Database