PatchSiren

PatchSiren cyber security CVE debrief

CVE-2026-44831 grokability CVE debrief

A stored cross-site scripting (XSS) vulnerability exists in Snipe-IT, an open-source IT asset and license management platform. The flaw affects versions prior to 8.4.1 and resides in the unescaped rendering of the notes column within the components module. Users with component view access can trigger or be affected by this vulnerability when malicious scripts are embedded in notes fields and subsequently rendered without proper sanitization. The CVSS 3.1 vector (AV:A/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N) indicates this requires adjacent network access, low attack complexity, low privileges, and user interaction, with scope change allowing impact on resources beyond the vulnerable component. The vulnerability was disclosed and fixed on May 26, 2026, with version 8.4.1 containing the remediation. No known exploitation in ransomware campaigns has been reported.

Vendor
grokability
Product
snipe-it
CVSS
MEDIUM 4.8
CISA KEV
Not listed in stored evidence
Original CVE published
2026-05-26
Original CVE updated
2026-05-26
Advisory published
2026-05-26
Advisory updated
2026-05-26

Who should care

Organizations using Snipe-IT for IT asset management, particularly those with multi-user environments where component view access is granted to non-administrative users. Security teams should prioritize patching if Snipe-IT instances are accessible from adjacent network segments or if user-generated content in asset notes is common.

Technical summary

The vulnerability stems from insufficient output encoding of the notes column in Snipe-IT's component management interface. When users with component view access encounter data containing malicious JavaScript in this field, the browser executes the script due to lack of proper HTML escaping. The attack requires the victim to have component view privileges and to interact with the compromised view. The scope change in CVSS indicates the vulnerable component can affect resources beyond its security scope, typical of XSS vulnerabilities where the script runs in the context of the application domain. The fix in version 8.4.1 implements proper escaping of the notes field content.

Defensive priority

medium

Recommended defensive actions

  • Upgrade Snipe-IT to version 8.4.1 or later to remediate this vulnerability
  • Review component notes fields for unexpected script content if running affected versions
  • Implement Content Security Policy headers as a defense-in-depth measure
  • Validate that user input in notes fields is properly escaped in custom deployments
  • Monitor for unusual script execution in component view contexts

Evidence notes

The vulnerability is classified under CWE-79 (Improper Neutralization of Input During Web Page Generation). The affected CPE configuration indicates all versions of Snipe-IT prior to 8.4.1 are vulnerable. The fix was implemented in commit 28f493d84d057895fbb93b6570e7393a2c2fa438.

Official resources

The vulnerability was published in the NVD on May 26, 2026 at 20:16 UTC and modified later that same day at 20:39 UTC. The vendor issued a security advisory and patch concurrently with this disclosure.