Vulnerability · Published Sep 8, 2026 · Assigned by VulnCheck

CVE-2026-86738Snipe-IT before 8.7.0 CSS Injection via Custom CSS

High 8.7

In plain English

A high-severity cross-site scripting in snipe-it from grokability. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.5% (higher than 42% of all known vulnerabilities).

Severity (CVSS 3.1)8.7High

Exploit odds (30 days)0.5%top 57.9% of all CVEs

Exploited in the wildNo reportsCISA SSVC: none

Attack toolingNoneno public tooling known

Official description

Snipe-IT versions before 8.7.0 contain a CSS injection vulnerability in the Custom CSS field due to incomplete sanitization that reverses HTML encoding on greater-than and double-quote characters. Superusers can plant malicious CSS payloads using @import and url() references to exfiltrate CSRF tokens from other superusers via attribute-selector rules, enabling account takeover.

Affected products (as reported)

Vendor	Product	Versions
grokability	snipe-it	0 – before 8.7.0

Weakness: CWE-79 · Vector: CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:N

References

GitHub Security Advisory (GHSA-pvcw-mp8q-mj39) vendor-advisory
Patch Commit patch
VulnCheck Advisory: Snipe-IT before 8.7.0 CSS Injection via Custom CSS third-party-advisory