CVE-2026-44831: Snipe-IT has Stored XSS via Component Checkout Notes (v8.4.0)

May 8, 2026 (updated June 8, 2026)

Users with component view access could be impacted by an unescaped notes column.

References

github.com/advisories/GHSA-r42m-953q-6vjx
github.com/grokability/snipe-it/commit/28f493d84d057895fbb93b6570e7393a2c2fa438
github.com/grokability/snipe-it/security/advisories/GHSA-r42m-953q-6vjx
nvd.nist.gov/vuln/detail/CVE-2026-44831

Code Behaviors & Features

Detect and mitigate CVE-2026-44831 with GitLab Dependency Scanning

Secure your software supply chain by verifying that all open source dependencies used in your projects contain no disclosed vulnerabilities. Dependency Scanning using SBOM also detects vulnerabilities from proprietary advisories that this site does not include. Learn more about Dependency Scanning using SBOM →