CVE-2026-86738: Snipeitapp Snipe-It

High severity, CVSS 8.7. EPSS: 0.5% chance of exploitation in the next 30 days.

Snipe-IT versions before 8.7.0 contain a CSS injection vulnerability in the Custom CSS field due to incomplete sanitization that reverses HTML encoding on greater-than and double-quote characters. Superusers can plant malicious CSS payloads using @import and url() references to exfiltrate CSRF tokens from other superusers via attribute-selector rules, enabling account takeover.

Affected products

• Snipeitapp Snipe-It: from 3.0.0, before 8.7.0 (fixed in 8.7.0)

Published 2026-09-08. Last modified 2026-09-09.