Snipe It Before 8.7.0 Css Injection Via Custom Css

Back www.vulncheck.com

Snipe It Before 8.7.0 Css Injection Via Custom Css

www.vulncheck.com • September 9, 2026

Share: View original

CWE-79 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

GitHub Security Advisory (GHSA-pvcw-mp8q-mj39)

Ready to get Started?

Vulnerability Prioritization Prioritize vulnerabilities that matter based on the threat landscape and defer vulnerabilities that don't.

Early Warning System Real-time alerting of changes in the vulnerability landscape so that you can take action before the attacks start.

The full story

This article is one source in a clustered incident — the cluster page carries the summary, timeline and every other outlet covering it.

Snipe-IT Vulnerabilities: RCE and CSS Injection Risks Identified Two critical vulnerabilities have been discovered in Snipe-IT versions prior to 8.7.0. The first, a remote code execution (RCE) vulnerability, is due to improper handling of backup restores, categorized as CWE-78. The second vulnerability allows CSS injection through custom CSS, classified as CWE-79. These vulnerabilities affect all versions before 8.7.0, potentially allowing attackers to execute arbitrary code or inject malicious scripts. The vulnerabilities have been documented in GitHub Security Advisories (GHSA-x53f-48vj-c5fc and GHSA-pvcw-mp8q-mj39). Users are urged to upgrade to version 8.7.0 or later to mitigate these risks. As of now, there is no indication of active exploitation in the wild, but the vulnerabilities are significant enough to warrant immediate attention. 57

Extracted Entities

Attack Types (1)

Cross-site Scripting

CWE Weaknesses (1)

CWE-79 - Cross-site Scripting (xss)