Live › vulnerability › CVE-2026-112290
Go to dashboardThe @ukic/canary-web-components package re-parses tree item label text as HTML when truncation is enabled, so escaped markup gets decoded and runs as JavaScript. An attacker who can influence a tree item label can run script in a visitor's browser.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-23 21:57 UTC. All times on this page are UTC.
Applications that use the @ukic/canary-web-components package in the 3.0.0-canary.12 to before 3.0.0-canary.48 range, with tree item truncation enabled and labels that an attacker can influence. Apps that do not use the canary package, or that never enable truncation on tree items, are less exposed.
No product ranges from the sources yet.
npm ls @ukic/canary-web-components to find the installed version.ic-tree-item and whether labels come from user-influenced data.@ukic/canary-web-components to 3.0.0-canary.48 or later.Each row is the first time that source carried this signal. The analyst’s rows are its own findings.
Intelligence Community UI Kit @ukic/canary-web-components 3.0.0-canary.12 before 3.0.0-canary.48 contains a DOM-based cross-site scripting vulnerability in ic-tree-item that re-parses router-item slot text as HTML. When tree item truncation is enabled, attackers who influence a tree item label can have escaped markup decoded by truncateTreeItemLabel() and executed as JavaScript in visitors' browsers.
This page as .md · .json · in your agent: get_signal("CVE-2026-112290")
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.