{"id":"CVE-2026-112290","title":"MI6 @ukic/canary-web-components 3.0.0-canary.12 before 3.0.0-canary.48 DOM XSS via ic-tree-item","summary":"Intelligence Community UI Kit @ukic/canary-web-components 3.0.0-canary.12 before 3.0.0-canary.48 contains a DOM-based cross-site scripting vulnerability in ic-tree-item that re-parses router-item slot text as HTML. When tree item truncat…","severity":"medium","cvss":4.7,"cvssVector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:L/I:L/A:N","cvssSource":"cna","cwe":["CWE-79"],"vendor":"MI6","product":"Intelligence Community UI Kit canary web components","affected":["intelligence_community_ui_kit_canary_web_components >= 3.0.0-canary.12 < 3.0.0-canary.48"],"published":"2026-10-19","updated":"2026-10-19","sourceUpdated":"2026-10-19T13:55:32.741Z","source":"CVEORG","sourceUrl":"https://www.cve.org/CVERecord?id=CVE-2026-112290","references":[{"url":"https://github.com/aaronamran/Public-Vulnerability-Disclosures/blob/main/2026/dom-xss-mi6-ic-ui-kit/README.md"},{"url":"https://github.com/mi6/ic-ui-kit/commit/e0eb0f16597dcb994a75c5230cd9243647ad7b3d"},{"url":"https://github.com/mi6/ic-ui-kit/blob/7b32c7c2b53b74a915f40984fb7b0a2d825fc49c/packages/canary-web-components/src/components/ic-tree-item/ic-tree-item.tsx"},{"url":"https://www.vulncheck.com/advisories/mi6-ukic-canary-web-components-3.0.0-canary.12-before-3.0.0-canary.48-dom-xss-via-ic-tree-item","label":"VulnCheck Advisory: MI6 @ukic/canary-web-components 3.0.0-canary.12 before 3.0.0-canary.48 DOM XSS via ic-tree-item"}],"tags":["cve.org"],"ingestedAt":"2026-10-19T14:30:01.068Z","slug":"CVE-2026-112290","body":"## Overview\n\nIntelligence Community UI Kit @ukic/canary-web-components 3.0.0-canary.12 before 3.0.0-canary.48 contains a DOM-based cross-site scripting vulnerability in ic-tree-item that re-parses router-item slot text as HTML. When tree item truncation is enabled, attackers who influence a tree item label can have escaped markup decoded by truncateTreeItemLabel() and executed as JavaScript in visitors' browsers.\n\n## Affected\n\n- `intelligence_community_ui_kit_canary_web_components >= 3.0.0-canary.12 < 3.0.0-canary.48`\n\n## Remediation\n\nRefer to the linked advisories for vendor-supplied fixes and affected version ranges.","depth":"sunlit","depthScore":26,"depthScoreParts":{"impact":25.9,"likelihood":0,"exploitation":0,"ransomware":0},"changes":[]}