---
id: CVE-2026-112290
title: >-
  MI6 @ukic/canary-web-components 3.0.0-canary.12 before 3.0.0-canary.48 DOM XSS
  via ic-tree-item
summary: >-
  Intelligence Community UI Kit @ukic/canary-web-components 3.0.0-canary.12
  before 3.0.0-canary.48 contains a DOM-based cross-site scripting vulnerability
  in ic-tree-item that re-parses router-item slot text as HTML. When tree item
  truncat…
severity: medium
cvss: 4.7
cvssVector: 'CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:L/I:L/A:N'
cvssSource: cna
cwe:
  - CWE-79
vendor: MI6
product: Intelligence Community UI Kit canary web components
affected:
  - >-
    intelligence_community_ui_kit_canary_web_components >= 3.0.0-canary.12 <
    3.0.0-canary.48
published: '2026-10-19'
updated: '2026-10-19'
sourceUpdated: '2026-10-19T13:55:32.741Z'
source: CVEORG
sourceUrl: 'https://www.cve.org/CVERecord?id=CVE-2026-112290'
references:
  - url: >-
      https://github.com/aaronamran/Public-Vulnerability-Disclosures/blob/main/2026/dom-xss-mi6-ic-ui-kit/README.md
  - url: >-
      https://github.com/mi6/ic-ui-kit/commit/e0eb0f16597dcb994a75c5230cd9243647ad7b3d
  - url: >-
      https://github.com/mi6/ic-ui-kit/blob/7b32c7c2b53b74a915f40984fb7b0a2d825fc49c/packages/canary-web-components/src/components/ic-tree-item/ic-tree-item.tsx
  - url: >-
      https://www.vulncheck.com/advisories/mi6-ukic-canary-web-components-3.0.0-canary.12-before-3.0.0-canary.48-dom-xss-via-ic-tree-item
    label: >-
      VulnCheck Advisory: MI6 @ukic/canary-web-components 3.0.0-canary.12 before
      3.0.0-canary.48 DOM XSS via ic-tree-item
tags:
  - cve.org
ingestedAt: '2026-10-19T14:30:01.068Z'
---

## Overview

Intelligence Community UI Kit @ukic/canary-web-components 3.0.0-canary.12 before 3.0.0-canary.48 contains a DOM-based cross-site scripting vulnerability in ic-tree-item that re-parses router-item slot text as HTML. When tree item truncation is enabled, attackers who influence a tree item label can have escaped markup decoded by truncateTreeItemLabel() and executed as JavaScript in visitors' browsers.

## Affected

- `intelligence_community_ui_kit_canary_web_components >= 3.0.0-canary.12 < 3.0.0-canary.48`

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.