Vulnerability · Published Oct 19, 2026 · Assigned by VulnCheck
CVE-2026-112290MI6 @ukic/canary-web-components 3.0.0-canary.12 before 3.0.0-canary.48 DOM XSS via ic-tree-item
Medium 4.7
In plain English
A medium-severity cross-site scripting in Intelligence Community UI Kit canary web components from MI6. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.2% (higher than 8% of all known vulnerabilities).
Official description
Intelligence Community UI Kit @ukic/canary-web-components 3.0.0-canary.12 before 3.0.0-canary.48 contains a DOM-based cross-site scripting vulnerability in ic-tree-item that re-parses router-item slot text as HTML. When tree item truncation is enabled, attackers who influence a tree item label can have escaped markup decoded by truncateTreeItemLabel() and executed as JavaScript in visitors' browsers.
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| MI6 | Intelligence Community UI Kit canary web components | 3.0.0-canary.12 – before 3.0.0-canary.48 |
Weakness: CWE-79 · Vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:L/I:L/A:N
References
- https://github.com/aaronamran/Public-Vulnerability-Disclosures/blob/main/2026/dom-xss-mi6-ic-ui-kit/README.md third-party-advisory
- https://github.com/mi6/ic-ui-kit/commit/e0eb0f16597dcb994a75c5230cd9243647ad7b3d patch
- https://github.com/mi6/ic-ui-kit/blob/7b32c7c2b53b74a915f40984fb7b0a2d825fc49c/packages/canary-web-components/src/components/ic-tree-item/ic-tree-item.tsx technical-description
- VulnCheck Advisory: MI6 @ukic/canary-web-components 3.0.0-canary.12 before 3.0.0-canary.48 DOM XSS via ic-tree-item third-party-advisory