CVE-2026-44831

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-44831", "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "state": "PUBLISHED", "assignerShortName": "GitHub_M", "dateReserved": "2026-05-07T21:21:48.351Z", "datePublished": "2026-05-26T19:27:16.856Z", "dateUpdated": "2026-05-27T16:08:45.980Z"}, "containers": {"cna": {"title": "Snipe-IT: XSS vulnerability in component notes", "problemTypes": [{"descriptions": [{"cweId": "CWE-79", "lang": "en", "description": "CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')", "type": "CWE"}]}], "metrics": [{"cvssV3_1": {"attackComplexity": "LOW", "attackVector": "ADJACENT_NETWORK", "availabilityImpact": "NONE", "baseScore": 4.8, "baseSeverity": "MEDIUM", "confidentialityImpact": "LOW", "integrityImpact": "LOW", "privilegesRequired": "LOW", "scope": "CHANGED", "userInteraction": "REQUIRED", "vectorString": "CVSS:3.1/AV:A/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N", "version": "3.1"}}], "references": [{"name": "https://github.com/grokability/snipe-it/security/advisories/GHSA-r42m-953q-6vjx", "tags": ["x_refsource_CONFIRM"], "url": "https://github.com/grokability/snipe-it/security/advisories/GHSA-r42m-953q-6vjx"}, {"name": "https://github.com/grokability/snipe-it/commit/28f493d84d057895fbb93b6570e7393a2c2fa438", "tags": ["x_refsource_MISC"], "url": "https://github.com/grokability/snipe-it/commit/28f493d84d057895fbb93b6570e7393a2c2fa438"}], "affected": [{"vendor": "grokability", "product": "snipe-it", "versions": [{"version": "< 8.4.1", "status": "affected"}]}], "providerMetadata": {"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "shortName": "GitHub_M", "dateUpdated": "2026-05-26T19:27:16.856Z"}, "descriptions": [{"lang": "en", "value": "Snipe-IT is an IT asset/license management system. Prior to 8.4.1, users with component view access could be impacted by an unescaped notes column, resulting in cross-site scripting (XSS). This vulnerability is fixed in 8.4.1."}], "source": {"advisory": "GHSA-r42m-953q-6vjx", "discovery": "UNKNOWN"}}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2026-05-27T16:05:13.462354Z", "id": "CVE-2026-44831", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-05-27T16:08:45.980Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2026-44831", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2026-05-27T16:05:13.462354Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-05-27T16:08:41.002Z"}}], "cna": {"title": "Snipe-IT: XSS vulnerability in component notes", "source": {"advisory": "GHSA-r42m-953q-6vjx", "discovery": "UNKNOWN"}, "metrics": [{"cvssV3_1": {"scope": "CHANGED", "version": "3.1", "baseScore": 4.8, "attackVector": "ADJACENT_NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:A/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N", "integrityImpact": "LOW", "userInteraction": "REQUIRED", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "LOW", "confidentialityImpact": "LOW"}}], "affected": [{"vendor": "grokability", "product": "snipe-it", "versions": [{"status": "affected", "version": "< 8.4.1"}]}], "references": [{"url": "https://github.com/grokability/snipe-it/security/advisories/GHSA-r42m-953q-6vjx", "name": "https://github.com/grokability/snipe-it/security/advisories/GHSA-r42m-953q-6vjx", "tags": ["x_refsource_CONFIRM"]}, {"url": "https://github.com/grokability/snipe-it/commit/28f493d84d057895fbb93b6570e7393a2c2fa438", "name": "https://github.com/grokability/snipe-it/commit/28f493d84d057895fbb93b6570e7393a2c2fa438", "tags": ["x_refsource_MISC"]}], "descriptions": [{"lang": "en", "value": "Snipe-IT is an IT asset/license management system. Prior to 8.4.1, users with component view access could be impacted by an unescaped notes column, resulting in cross-site scripting (XSS). This vulnerability is fixed in 8.4.1."}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-79", "description": "CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')"}]}], "providerMetadata": {"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "shortName": "GitHub_M", "dateUpdated": "2026-05-26T19:27:16.856Z"}}}, "cveMetadata": {"cveId": "CVE-2026-44831", "state": "PUBLISHED", "dateUpdated": "2026-05-27T16:08:45.980Z", "dateReserved": "2026-05-07T21:21:48.351Z", "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "datePublished": "2026-05-26T19:27:16.856Z", "assignerShortName": "GitHub_M"}, "dataVersion": "5.2"}

{"affected": [{"affectedData": [{"product": "snipe-it", "vendor": "grokability", "versions": [{"status": "affected", "version": "< 8.4.1"}]}], "source": "security-advisories@github.com"}], "configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:a:snipeitapp:snipe-it:*:*:*:*:*:*:*:*", "matchCriteriaId": "EB07F5CD-5BCC-4858-8FAD-10A9DBEE5466", "versionEndExcluding": "8.4.1", "vulnerable": true}], "negate": false, "operator": "OR"}]}], "cveTags": [], "descriptions": [{"lang": "en", "value": "Snipe-IT is an IT asset/license management system. Prior to 8.4.1, users with component view access could be impacted by an unescaped notes column, resulting in cross-site scripting (XSS). This vulnerability is fixed in 8.4.1."}, {"lang": "es", "value": "Snipe-IT es un sistema de gesti\u00f3n de activos/licencias de TI. Antes de la versi\u00f3n 8.4.1, los usuarios con acceso de vista de componentes podr\u00edan verse afectados por una columna de notas sin escapar, lo que resultaba en cross-site scripting (XSS). Esta vulnerabilidad est\u00e1 corregida en la versi\u00f3n 8.4.1."}], "id": "CVE-2026-44831", "lastModified": "2026-07-24T11:10:00.170", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "ADJACENT_NETWORK", "availabilityImpact": "NONE", "baseScore": 4.8, "baseSeverity": "MEDIUM", "confidentialityImpact": "LOW", "integrityImpact": "LOW", "privilegesRequired": "LOW", "scope": "CHANGED", "userInteraction": "REQUIRED", "vectorString": "CVSS:3.1/AV:A/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N", "version": "3.1"}, "exploitabilityScore": 1.7, "impactScore": 2.7, "source": "security-advisories@github.com", "type": "Secondary"}, {"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 5.4, "baseSeverity": "MEDIUM", "confidentialityImpact": "LOW", "integrityImpact": "LOW", "privilegesRequired": "LOW", "scope": "CHANGED", "userInteraction": "REQUIRED", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N", "version": "3.1"}, "exploitabilityScore": 2.3, "impactScore": 2.7, "source": "nvd@nist.gov", "type": "Primary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-44831", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "partial"}], "role": "CISA Coordinator", "timestamp": "2026-05-27T16:05:13.462354Z", "version": "2.0.3"}}]}, "published": "2026-05-26T20:16:20.027", "references": [{"source": "security-advisories@github.com", "tags": ["Patch"], "url": "https://github.com/grokability/snipe-it/commit/28f493d84d057895fbb93b6570e7393a2c2fa438"}, {"source": "security-advisories@github.com", "tags": ["Patch", "Vendor Advisory"], "url": "https://github.com/grokability/snipe-it/security/advisories/GHSA-r42m-953q-6vjx"}], "sourceIdentifier": "security-advisories@github.com", "vulnStatus": "Analyzed", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-79"}], "source": "security-advisories@github.com", "type": "Secondary"}]}

{}

{"affected": [{"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "[0,8.4.1)"}}], "enrichment": {"confidence": 100.0, "confidence_source": "matching", "scores": [{"score": 100.0, "source": "matching"}]}, "original": {"product": "snipe-it", "source": "cna", "vendor": "grokability"}, "product": "snipe-it", "vendor": "grokability"}], "created": "2026-05-26T20:30:14.726337+00:00", "updated": "2026-05-26T20:30:15.191588+00:00", "vendors": ["grokability", "grokability$PRODUCT$snipe-it"]}