EUVD-2026-31960
GHSA-r42m-953q-6vjx
Severity by source
AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N
Stored XSS is injected and retrieved over HTTP (AV:N); PR:L reflects required authenticated write access to component notes; UI:R and S:C are standard for stored XSS with browser scope change.
Primary rating from NVD.
CVSS VectorNVD
Lifecycle Timeline
4DescriptionNVD
Impact
Users with component view access could be impacted by an unescaped notes column.
Patches
This was patched in https://github.com/grokability/snipe-it/commit/28f493d84d057895fbb93b6570e7393a2c2fa438, and is fixed in v8.4.1 or greater.
Workarounds
None.
AnalysisAI
Stored XSS in Snipe-IT prior to v8.4.1 allows an authenticated user with component write access to inject arbitrary JavaScript into the checkout notes field, which executes in the browser of any user who subsequently views the component checkout list. The vulnerable code path is in ComponentsTransformer.php, where $asset->pivot->note was returned raw without HTML entity escaping. No public exploit has been identified at time of analysis, and the EPSS score of 0.01% reflects negligible automated exploitation interest, but the stored nature of the payload and scope change (S:C) make it a meaningful risk for multi-tenant or privilege-sensitive Snipe-IT deployments.
Technical ContextAI
Snipe-IT is an open-source IT asset management platform built on the Laravel PHP framework (CPE: pkg:composer/snipe/snipe-it). The vulnerability resides in app/Http/Transformers/ComponentsTransformer.php within the transformCheckedoutComponents method, which serializes component checkout records for API or view consumption. The note field from the pivot table ($asset->pivot->note) was interpolated directly into the output without applying Laravel's e() helper, which performs HTML entity encoding (htmlspecialchars). CWE-79 (Improper Neutralization of Input During Web Page Generation) is the root cause - user-controlled input was stored and later rendered without output encoding, the textbook stored XSS pattern. The one-line fix ('note' => e($asset->pivot->note)) confirms the root cause is purely missing output encoding, not a structural design flaw.
RemediationAI
Upgrade Snipe-IT to version 8.4.1 or greater, which applies the fix in commit 28f493d84d057895fbb93b6570e7393a2c2fa438 (available at https://github.com/grokability/snipe-it/commit/28f493d84d057895fbb93b6570e7393a2c2fa438). The vendor advisory at https://github.com/grokability/snipe-it/security/advisories/GHSA-r42m-953q-6vjx confirms no workarounds exist. For environments that cannot immediately upgrade, a compensating control is to restrict the ability to write component checkout notes to only highly trusted accounts, reducing the attacker surface - however, this does not eliminate the vulnerability if any trusted account is compromised. Organizations using Snipe-IT behind an internal network boundary should also ensure Content Security Policy (CSP) headers are configured to restrict inline script execution, which would reduce the impact of any stored XSS payload.
Same weakness CWE-79 – Cross-site Scripting (XSS)
View allShare
External POC / Exploit Code
Leaving vuln.today