CVE-2026-61807
Description
Snipe-IT is an IT asset/license management system. Prior to 8.6.2, a stored manufacturer or supplier name passed as the table component $name becomes data-selected-count-id in resources/views/partials/bootstrap-table.blade.php. Client-side code reads the browser-decoded countId, uses it as a selector, concatenates countId.substring(1) into an HTML string, and passes the string to jQuery .after(). A crafted name can therefore execute JavaScript when an authenticated user views the manufacturer detail page or supplier detail page, potentially exposing data or actions available to that session. This issue is fixed in version 8.6.2.
AI Insight
LLM-synthesized narrative grounded in this CVE's description and references.
Affected packages
Versions sourced from the GitHub Security Advisory.
| Package | Affected versions | Patched versions |
|---|---|---|
snipe/snipe-itPackagist | < 8.6.2 | 8.6.2 |
Affected products
2- Range: <8.6.2
Patches
Vulnerability mechanics
References
4- github.com/grokability/snipe-it/commit/d12ad3d53869443b96b663ba3ce2673ef343da71nvdPatchWEB
- github.com/grokability/snipe-it/releases/tag/v8.6.2nvdRelease NotesPatchWEB
- github.com/grokability/snipe-it/security/advisories/GHSA-c8qc-wf67-342wnvdExploitPatchVendor AdvisoryWEB
- github.com/advisories/GHSA-c8qc-wf67-342wghsaADVISORY
News mentions
0No linked articles in our index yet.