CVE-2026-61807: Stored DOM-Based Cross-Site Scripting in Snipe-IT

Snipe-IT is an open-source asset management platform built on the Laravel framework. The application relies on client-side components to manage dynamic data visualization, specifically utilizing jQuery and Bootstrap Table. These table structures render elements with dynamic attributes derived from user-defined metadata, such as manufacturer and supplier names. This architecture presents an attack surface when user inputs are processed through client-side scripting sinks.\n\nThe vulnerability classified as CVE-2026-61807 represents a Stored DOM-based Cross-Site Scripting (DOM XSS) flaw. An authenticated attacker with permissions to create or update manufacturer or supplier resources can insert HTML metacharacters into the name fields. Because the backend does not sanitize or strip these characters during CamelCase transformation, the payload remains intact. When other users view these pages, the client-side JavaScript reads the decoded attribute and executes the injected script.\n\nThe impact is localized primarily to the browser session of the victim, which can be an administrator. This execution context allows session hijacking, token theft, and administrative actions performed on behalf of the victim. This analysis investigates the root cause, exploitation methodology, and remediation actions required to eliminate the vulnerability.

The root cause of CVE-2026-61807 is located in the sequence of template rendering and subsequent DOM manipulation. In the Laravel Blade template, the data-selected-count-id attribute is assigned a value that represents a camel-cased version of the manufacturer or supplier name. The application utilizes the Illuminate\\Support\\Str::camel() helper function to format the string. While this helper converts word spacing and case structures, it does not neutralize or escape HTML metacharacters.\n\nWhen rendering the page, Laravel Blade escapes HTML special characters inside the attribute to prevent direct server-side HTML injection. However, once the document object model is fully initialized, the web browser automatically decodes these entities. When client-side scripts query the attribute, they receive the decoded, raw text representation. This is where the transition from server-side security to client-side risk occurs.\n\nThe client-side script uses jQuery's .data('selected-count-id') method to extract the formatted identifier. In jQuery, .data() automatically parses and decodes the requested attribute, preserving the dangerous payload. The application then performs a substring operation to strip the leading symbol and concatenates this value into a raw HTML template. This concatenated string is passed directly to jQuery's .after() method, which functions as an active DOM sink.

To understand the exact mechanics of the vulnerability, we must examine the difference between the vulnerable codebase and the patched implementation. The vulnerable code constructs an HTML string by directly concatenating the user-controlled countId value. This pattern is risky because it allows arbitrary HTML elements and script handlers to be parsed by jQuery.\n\njavascript\n// Vulnerable implementation in resources/views/partials/bootstrap-table.blade.php\nvar countId = $(this).data('selected-count-id');\nif (!countId) return;\nvar $paginationDetail = $(this).closest('.bootstrap-table')\n .find('.fixed-table-pagination').first()\n .find('.pagination-detail');\nif ($paginationDetail.length && $(countId).length === 0) {\n // Dangerous HTML construction via string concatenation\n $paginationDetail.after('<span id="' + countId.substring(1) + '" style="display:none; float:left; margin-top:10px; margin-bottom:10px; margin-left:10px; line-height:34px;">&mdash; <span class="badge">0</span> {{ trans(\'general.selected\') }}</span>');\n}\n\n\nThe patched version resolves this vulnerability by completely removing the raw HTML string concatenation pattern. Instead, it utilizes secure jQuery element constructors where attributes are defined as key-value pairs, preventing syntax-level injection. Furthermore, the patch utilizes document.createTextNode() to append the delimiter and label text. This forces the browser to treat the input strictly as plain-text data rather than executable markup.\n\njavascript\n// Patched implementation utilizing programmatic DOM element construction\nif ($paginationDetail.length && !document.getElementById(rawCountId)) {\n var $selectedCount = $('<span/>', {\n id: rawCountId,\n style: 'display:none; float:left; margin-top:10px; margin-bottom:10px; margin-left:10px; line-height:34px;'\n });\n // Text nodes prevent the parsing of HTML tags and script elements\n $selectedCount.append(document.createTextNode('— '));\n $selectedCount.append($('<span/>', { 'class': 'badge', text: '0' }));\n $selectedCount.append(document.createTextNode(' {{ trans(\'general.selected\') }}'));\n $paginationDetail.after($selectedCount);\n}\n

Exploitation of this vulnerability requires the attacker to have privileges to create or edit manufacturers or suppliers. An attacker with asset manager credentials can navigate to the creation interface and insert a specially crafted payload into the "Name" field. The payload must bypass the CamelCase transformation while retaining valid HTML metacharacters. A payload structure such as x[foo=\'><svg/onload=alert(document.cookie)>\'] achieves this.\n\nWhen an administrative user or any other operator accesses the detail page for the affected manufacturer, the server generates the page containing the bootstrap table. The table element is rendered with the malicious payload nested inside the data-selected-count-id attribute. Because the browser parses the attribute context, it decodes the entities. The client-side Bootstrap Table script then executes on the post-body.bs.table event.\n\nThe client-side code retrieves the attribute value, extracts the payload, and performs unsafe string concatenation. When jQuery's .after() method parses the output, the injected <svg> block is integrated into the DOM. The browser immediately processes the SVG element and executes the nested JavaScript handler. This executing payload operates within the security context of the victim's session, enabling actions such as session hijacking or API manipulation.

The impact of this vulnerability is assessed as Medium severity, with a CVSS v4.0 base score of 6.3. The attack requires low-privileged credentials and relies on passive user interaction. However, the subsequent impact on the confidentiality and integrity of the victim's session is high. If the victim has administrative privileges, the attacker can hijack the session completely.\n\nAn administrative session hijack within Snipe-IT allows the attacker to read, modify, or delete sensitive IT assets, licenses, and user directories. The attacker can execute arbitrary API calls, manipulate hardware allocations, or potentially configure backdoors in the system. Because Snipe-IT acts as a central repository for an enterprise's IT hardware and software assets, access to this platform poses a risk to overall infrastructure integrity.\n\nCurrently, this vulnerability is not listed in CISA's Known Exploited Vulnerabilities catalog, and there are no active weaponized exploits publicly available. The Exploit Prediction Scoring System score is low, reflecting the localized nature of the flaw. However, security teams must treat this with priority because the barrier to entry for exploitation is low once credentials are acquired.

The definitive remediation for CVE-2026-61807 is upgrading the Snipe-IT installation to version 8.6.2 or higher. This version integrates the secure DOM construction methods described in the code analysis, resolving the underlying vulnerability. Administrators should apply the update during a standard maintenance window. No additional database migrations are required to implement this fix.\n\nFor environments where an immediate upgrade is not feasible, temporary mitigation strategies can be implemented. Configuring a robust Content Security Policy (CSP) that prohibits inline scripts provides significant defense against this vector. Snipe-IT includes native support for CSP, which can be activated by setting ENABLE_CSP=true in the environment configuration file. This stops the execution of injected script tags even if the DOM is successfully modified.\n\nAdditionally, administrators can restrict write access to the manufacturer and supplier creation interfaces to reduce the attack surface. Implementing network segregation and monitoring application access logs for unexpected metacharacters in input parameters are also recommended. These defense-in-depth measures provide temporary protection until the application is fully patched.