---
id: CVE-2026-61807
title: Snipe-IT is an IT asset/license management system
summary: >-
  Snipe-IT is an IT asset/license management system. Prior to 8.6.2, a stored
  manufacturer or supplier name passed as the table component $name becomes
  data-selected-count-id in resources/views/partials/bootstrap-table.blade.php.
  Client-si…
severity: medium
cwe:
  - CWE-79
vendor: snipe
product: snipe/snipe-it
affected:
  - snipe/snipe-it < 8.6.2
patched:
  - snipe/snipe-it 8.6.2
published: '2026-08-19'
updated: '2026-09-09'
sourceUpdated: '2026-09-09T21:19:49.197'
source: NVD
sourceUrl: 'https://nvd.nist.gov/vuln/detail/CVE-2026-61807'
references:
  - url: >-
      https://github.com/grokability/snipe-it/commit/d12ad3d53869443b96b663ba3ce2673ef343da71
    label: security-advisories@github.com
  - url: 'https://github.com/grokability/snipe-it/releases/tag/v8.6.2'
    label: security-advisories@github.com
  - url: >-
      https://github.com/grokability/snipe-it/security/advisories/GHSA-c8qc-wf67-342w
    label: security-advisories@github.com
  - url: 'https://github.com/advisories/GHSA-c8qc-wf67-342w'
tags:
  - nvd
  - ghsa
  - composer
epss: 0.00284
epssPercentile: 0.21211
aliases:
  - GHSA-c8qc-wf67-342w
ecosystem: composer
ingestedAt: '2026-08-19T19:44:02.480Z'
---

## Overview

Snipe-IT is an IT asset/license management system. Prior to 8.6.2, a stored manufacturer or supplier name passed as the table component $name becomes data-selected-count-id in resources/views/partials/bootstrap-table.blade.php. Client-side code reads the browser-decoded countId, uses it as a selector, concatenates countId.substring(1) into an HTML string, and passes the string to jQuery .after(). A crafted name can therefore execute JavaScript when an authenticated user views the manufacturer detail page or supplier detail page, potentially exposing data or actions available to that session. This issue is fixed in version 8.6.2.

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.

## Package advisory (CVE-2026-61807)

Affected packages:

- `snipe/snipe-it < 8.6.2`

Patched in:

- `snipe/snipe-it 8.6.2`

Source: https://github.com/advisories/GHSA-c8qc-wf67-342w