DOM-Based Cross-Site Scripting in MI6 Intelligence Community UI Kit
CVE-2026-112290

2.3LOW

Key Information:

Vendor

Mi6

Status
Intelligence Community Ui Kit Canary Web Components
Vendor
CVE Published:
19 October 2026

What is CVE-2026-112290?

The Intelligence Community UI Kit version 3.0.0-canary.12 prior to 3.0.0-canary.48 is susceptible to a DOM-based cross-site scripting vulnerability. Specifically, the issue arises in the ic-tree-item component, where the router-item slot text is improperly re-parsed as HTML. If tree item truncation is enabled, attackers can manipulate the text of a tree item label, leading to the execution of malicious JavaScript code in the browsers of unsuspecting users through the decode function of truncateTreeItemLabel().

Affected Version(s)

Intelligence Community UI Kit canary web components 3.0.0-canary.12 < 3.0.0-canary.48

References

https://github.com/aaronamran/Public-Vulnerability-Disclo...
third-party-advisory
https://github.com/mi6/ic-ui-kit/commit/e0eb0f16597dcb994...
patch
https://github.com/mi6/ic-ui-kit/blob/7b32c7c2b53b74a915f...
technical-description

CVSS V4

Score:
2.3
Severity:
LOW
Confidentiality:
Low
Integrity:
Low
Availability:
None
Attack Vector:
Network
Attack Complexity:
High
Attack Required:
Physical
Privileges Required:
Undefined
User Interaction:
Unknown

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

Aaron Amran Bin Amiruddin (@aaronamran)
.