Intelligence Community UI Kit @ukic/canary-web-components 3.0.0-canary.12 before 3.0.0-canary.48 contains a DOM-based cross-site scripting vulnerability in ic-tree-item that re-parses router-item slot text as HTML. When tree item truncation is enabled, attackers who influence a tree item label can have escaped markup decoded by truncateTreeItemLabel() and executed as JavaScript in visitors' browsers.

Metrics

Attack Vector Network

Attack Complexity High

Privileges Required None

Attack Requirements Present

User Interaction Passive

Vulnerable System Confidentiality Impact Low

Vulnerable System Integrity Impact Low

Vulnerable System Availability Impact None

Subsequent System Confidentiality Impact Low

Subsequent System Integrity Impact Low

Subsequent System Availability Impact None

Attack Vector Network

Attack Complexity High

Privileges Required None

Scope Changed

Confidentiality Impact Low

Integrity Impact Low

Availability Impact None

User Interaction Required

No CVSS v3.0

No CVSS v2

This CVE is not in the KEV list.

Exploitation none

Automatable no

Technical Impact partial

Affected Vendors & Products

Vendors Products
Mi6
  • Intelligence Community Ui Kit Canary Web Components

No data.

No data.

References
Link Providers
https://github.com/aaronamran/Public-Vulnerability-Disclosures/blob/main/2026/dom-xss-mi6-ic-ui-kit/README.md cve-icon cve-icon
https://github.com/mi6/ic-ui-kit/blob/7b32c7c2b53b74a915f40984fb7b0a2d825fc49c/packages/canary-web-components/src/components/ic-tree-item/ic-tree-item.tsx cve-icon cve-icon
https://github.com/mi6/ic-ui-kit/commit/e0eb0f16597dcb994a75c5230cd9243647ad7b3d cve-icon cve-icon
https://www.vulncheck.com/advisories/mi6-ukic-canary-web-components-3.0.0-canary.12-before-3.0.0-canary.48-dom-xss-via-ic-tree-item cve-icon cve-icon
History

Wed, 21 Oct 2026 17:15:00 +0000

Type Values Removed Values Added
First Time appeared Mi6
Mi6 intelligence Community Ui Kit Canary Web Components
Vendors & Products Mi6
Mi6 intelligence Community Ui Kit Canary Web Components

Mon, 19 Oct 2026 17:30:00 +0000

Type Values Removed Values Added
Metrics ssvc

{'options': {'Automatable': 'no', 'Exploitation': 'none', 'Technical Impact': 'partial'}, 'version': '2.0.3'}

Mon, 19 Oct 2026 14:15:00 +0000

Type Values Removed Values Added
Description Intelligence Community UI Kit @ukic/canary-web-components 3.0.0-canary.12 before 3.0.0-canary.48 contains a DOM-based cross-site scripting vulnerability in ic-tree-item that re-parses router-item slot text as HTML. When tree item truncation is enabled, attackers who influence a tree item label can have escaped markup decoded by truncateTreeItemLabel() and executed as JavaScript in visitors' browsers.
Title MI6 @ukic/canary-web-components 3.0.0-canary.12 before 3.0.0-canary.48 DOM XSS via ic-tree-item
Weaknesses CWE-79
References
Metrics cvssV3_1

{'score': 4.7, 'vector': 'CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:L/I:L/A:N'}

cvssV4_0

{'score': 2.3, 'vector': 'CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:P/VC:L/VI:L/VA:N/SC:L/SI:L/SA:N'}
cve-icon MITRE

Status: PUBLISHED

Assigner: VulnCheck

Published: 2026-10-19T13:55:32.741Z

Updated: 2026-10-19T16:34:26.673Z

Reserved: 2026-10-19T13:25:33.796Z

Link: CVE-2026-112290

cve-icon Vulnrichment

Updated: 2026-10-19T15:36:09.583Z

cve-icon NVD

Status : Awaiting Analysis

Published: 2026-10-19T14:17:07.600

Modified: 2026-10-19T21:13:39.973

Link: CVE-2026-112290

cve-icon Redhat

No data.