IC UI Kit CVE-2026-112290

Exploitation requires three concrete prerequisites: (1) tree item truncation must be enabled on the ic-tree-item component, since the flaw lives in truncateTreeItemLabel(); (2) the attacker must be able to influence the text of an ic-tree-item router-item slot label, supplying HTML-escaped markup; and (3) a victim must view the rendered tree so the decoded markup is parsed and executed. Limiting factors that reduce realistic risk: the vulnerable code path only runs when the non-default truncation feature is enabled (AT:P), user interaction is needed to render/view the tree (UI:P), the impact is confined to the victim's browser (Low C/I, no availability), and only the pre-release canary versions 3.0.0-canary.12 through 3.0.0-canary.47 of @ukic/canary-web-components are affected.

All signals point to genuinely LOW real-world risk, and they are internally consistent rather than conflicting. The vendor CVSS 4.0 base score is 2.3 (Low), driven by AC:H (high attack complexity), AT:P (a present attack requirement - truncation must be enabled), UI:P (passive user interaction required to view the rendered tree), and only Low vulnerable-system confidentiality/integrity impact (VC:L/VI:L) with no availability impact. This is a DOM-based XSS confined to the victim's browser session, not a server-compromise primitive. No EPSS score was provided in the input and the CVE is NOT on the CISA KEV list, so there is no evidence of active exploitation; a public disclosure writeup and the fixing commit diff are available, meaning exploitation detail is public but that is distinct from in-the-wild use. The input CVSS vector is a 4.0 vector (not 3.1) and contains PR:N, so exploitation does not require attacker authentication, though it does require the attacker to influence a tree item label and the non-default truncation feature to be enabled. Net: this is a low-CVSS, low-real-risk issue limited to a niche pre-release component library - patch on a routine cycle rather than as an emergency.

An attacker who can influence the text of a tree item's router-item slot label (for example via user-supplied data rendered into an ic-tree-item) submits escaped HTML markup. When an application has tree item truncation enabled, truncateTreeItemLabel() decodes that text back into HTML via innerHTML, so when a victim views the tree the markup is parsed and the embedded JavaScript executes in their browser. A public disclosure writeup and the fixing commit diff exist, so publicly available exploit detail effectively exists, but there is no indication of active exploitation.