CVE-2026-112290
MI6 @ukic/canary-web-components 3.0.0-canary.12 before 3.0.0-canary.48 DOM XSS via ic-tree-item
CVSS Score
4.7
EPSS Score
0.0%
EPSS Percentile
0th
Intelligence Community UI Kit @ukic/canary-web-components 3.0.0-canary.12 before 3.0.0-canary.48 contains a DOM-based cross-site scripting vulnerability in ic-tree-item that re-parses router-item slot text as HTML. When tree item truncation is enabled, attackers who influence a tree item label can have escaped markup decoded by truncateTreeItemLabel() and executed as JavaScript in visitors' browsers.
| CWE | CWE-79 |
| Vendor | mi6 |
| Product | intelligence community ui kit canary web components |
| Published | Oct 19, 2026 |
| Last Updated | Oct 19, 2026 |
Stay Ahead of the Next One
Get instant alerts for mi6 intelligence community ui kit canary web components
Be the first to know when new medium vulnerabilities affecting mi6 intelligence community ui kit canary web components are published — delivered to Slack, Telegram or Discord.
Get Free Alerts →
Free · No credit card · 60 sec setup
CVSS v3 Breakdown
CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:L/I:L/A:N Attack Vector
Network
Attack Complexity
High
Privileges Required
None
User Interaction
Required
Scope
Changed
Confidentiality
Low
Integrity
Low
Availability
None
Affected Versions
MI6 / Intelligence Community UI Kit canary web components
3.0.0-canary.12 < 3.0.0-canary.48
References
github.com: https://github.com/aaronamran/Public-Vulnerability-Disclosures/blob/main/2026/dom-xss-mi6-ic-ui-kit/README.md github.com: https://github.com/mi6/ic-ui-kit/commit/e0eb0f16597dcb994a75c5230cd9243647ad7b3d github.com: https://github.com/mi6/ic-ui-kit/blob/7b32c7c2b53b74a915f40984fb7b0a2d825fc49c/packages/canary-web-components/src/components/ic-tree-item/ic-tree-item.tsx vulncheck.com: https://www.vulncheck.com/advisories/mi6-ukic-canary-web-components-3.0.0-canary.12-before-3.0.0-canary.48-dom-xss-via-ic-tree-item
Credits
Aaron Amran Bin Amiruddin (@aaronamran)