GHSA-p9h3-gvpq-5539
Suggest an improvement- Source
- https://github.com/advisories/GHSA-p9h3-gvpq-5539
- Import Source
- https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/09/GHSA-p9h3-gvpq-5539/GHSA-p9h3-gvpq-5539.json
- JSON Data
- https://api.osv.dev/v1/vulns/GHSA-p9h3-gvpq-5539
- Aliases
- Published
- 2026-09-24T18:19:30Z
- Modified
- 2026-09-24T18:28:27Z
- Severity
-
- 8.1 (High) CVSS_V3 - CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:H/I:H/A:N CVSS Calculator
- Summary
- Snipe-IT: Stored XSS via Custom Field name in asset-list column headers
- Details
-
Impact
A user with the "customfields.create" permission can store HTML/JS in a Custom Field name, which is later rendered as an asset-list column title WITHOUT escaping at app/Presenters/AssetPresenter.php line 364 ('title' => $field->name) and injected into the table header by the bundled bootstrap-table plugin. It executes for anyone who opens an asset list (e.g. /hardware), including superusers, on page load with no interaction. Since "customfields.create" can be granted to non-superusers, a lower-privileged user gets script execution in a superuser's session -> privilege escalation.
STEPS TO REPRODUCE
- As a user with "customfields.create", create a Custom Field named:
<img src=x onerror=alert(1)> - Add the field to a fieldset that is associated with an asset model.
- Open
/hardware-> the payload executes on load.
DEMONSTRATED IMPACT An account holding ONLY "customfields.create" (HTTP 403 on /users) planted a payload that, when a superuser opened /hardware, issued an authenticated request in that session and granted the attacker's own account the "superuser" permission (afterwards: GET /users = 200, isSuperUser() = true).
ROOT CAUSE
- Blade {{ }} encodes the data-columns attribute, but the browser decodes it back before bootstrap-table reads the title; bootstrap-table then renders the header title unescaped because its table-level "escape" option defaults to false and is never enabled. (The per-column 'escape' => true covers cell values, not the header title.)
Patches
Patched in https://github.com/grokability/snipe-it/commit/58754e4e3b86b58a0c4523012ef04a2ae990d2c8
- As a user with "customfields.create", create a Custom Field named:
- Database specific
{ "cwe_ids": [ "CWE-79" ], "github_reviewed": true, "github_reviewed_at": "2026-09-24T18:19:30Z", "nvd_published_at": null, "severity": "HIGH" }- References
Affected packages
Packagist / snipe/snipe-it
Package
- Name
- snipe/snipe-it
- Purl
- pkg:composer/snipe/snipe-it
Affected ranges
- Type
- ECOSYSTEM
- Events
-
Introduced0 Unknown introduced version / All previous versions are affectedFixed8.7.0