CVE-2026-55481CWE-79

Snipe-IT: CSS Injection via `header_color` Setting

Medium · published July 10, 2026

CVSS v4.0
6.2
EPSS
0%
Percentile
23.0
In the wild
Unconfirmed
What it is

Snipe-IT is an IT asset/license management system. Prior to 8.6.2, default.blade.php renders header_color and related branding color settings inside a CSS style block with HTML escaping that is insufficient for the CSS context, allowing a superadmin to inject arbitrary CSS that affects authenticated users on subsequent page loads when Content Security Policy is disabled. This issue is fixed in version 8.6.2.

The record
Technical detail
CVSS v4.0
6.2 · MEDIUM
Vector
CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:P/VC:N/VI:N/VA:N/SC:H/SI:H/SA:N
EPSS
0.00315 · 23.0th percentile
Weakness
CWE-79 · Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
Published
2026-07-10T19:45Z
EPSS history
Timeline
  • 10 JUL 19:45Z
    Snipe-IT: CSS Injection via `header_color` Setting
    cvelistv5