CSS Injection Vulnerability in Snipe-IT Asset Management System

CVE-2026-55481

What is CVE-2026-55481?

Snipe-IT, an IT asset and license management system, is vulnerable to CSS injection due to inadequate HTML escaping in the default.blade.php file. This vulnerability allows a superadmin to inject arbitrary CSS that can alter the appearance and functionality of the interface for authenticated users on subsequent page loads, particularly when the Content Security Policy is disabled. This issue has been addressed in version 8.6.2, making it crucial for users to update to the latest version to safeguard against such injection attacks.

References