{"id":"CVE-2026-112290","kind":"vulnerability","aliases":["CVE-2026-112290"],"related":[],"title":"UKIC canary web components: DOM XSS in ic-tree-item labels","description":"Intelligence Community UI Kit @ukic/canary-web-components 3.0.0-canary.12 before 3.0.0-canary.48 contains a DOM-based cross-site scripting vulnerability in ic-tree-item that re-parses router-item slot text as HTML. When tree item truncation is enabled, attackers who influence a tree item label can have escaped markup decoded by truncateTreeItemLabel() and executed as JavaScript in visitors' browsers.","summary":"The @ukic/canary-web-components package re-parses tree item label text as HTML when truncation is enabled, so escaped markup gets decoded and runs as JavaScript. An attacker who can influence a tree item label can run script in a visitor's browser.","severity":"medium","cvss":4.7,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["frontend","javascript","package","web-components"],"not_affected_if":["default-config","no-user-controlled-labels"],"how_to_check":"- Run `npm ls @ukic/canary-web-components` to find the installed version.\n- Check whether the app enables tree item truncation on `ic-tree-item` and whether labels come from user-influenced data.","fix":"- Upgrade `@ukic/canary-web-components` to `3.0.0-canary.48` or later.","status":"open","published_at":"2026-10-19T14:17:07+00:00","first_seen_at":"2026-10-23T21:57:18+00:00","triaged_at":"2026-10-25T04:35:17+00:00","updated_at":"2026-10-25T04:35:17+00:00","category":"package","confidence":0.7,"triage":{"at":"2026-10-25T04:35:17Z","model":"claude-haiku-5-5","output":{"fix":"- Upgrade `@ukic/canary-web-components` to `3.0.0-canary.48` or later.","reach":"internet","title":"UKIC canary web components: DOM XSS in ic-tree-item labels","impact":"medium","summary":"The @ukic/canary-web-components package re-parses tree item label text as HTML when truncation is enabled, so escaped markup gets decoded and runs as JavaScript. An attacker who can influence a tree item label can run script in a visitor's browser.","category":"package","nicknames":[],"who_cares":["javascript","web-components","frontend"],"confidence":0.7,"needs_auth":"unknown","worst_case":"Attacker script runs in visitors' browsers on the affected site.","analyst_note":"","how_to_check":"- Run `npm ls @ukic/canary-web-components` to find the installed version.\n- Check whether the app enables tree item truncation on `ic-tree-item` and whether labels come from user-influenced data.","needs_analyst":false,"not_affected_if":["default-config","no-user-controlled-labels"],"who_is_affected":"Applications that use the @ukic/canary-web-components package in the 3.0.0-canary.12 to before 3.0.0-canary.48 range, with tree item truncation enabled and labels that an attacker can influence. Apps that do not use the canary package, or that never enable truncation on tree items, are less exposed.","user_interaction":"yes","needs_special_setup":"yes","severity_if_unknown":"medium"},"cost_usd":0.000598,"input_tokens":3388,"output_tokens":518,"severity_before":"medium"},"analyst_status":null,"analyst_note":null,"search":"'-112290':15A,18A '-2026':14A,17A '3.0.0':72C,75C 'attack':51B,109C 'base':81C 'browser':66B,129C 'canari':2A 'canary.12':73C 'canary.48':76C 'communiti':68C 'compon':4A,24B 'contain':77C 'cross':83C 'cross-sit':82C 'cve':13A,16A 'decod':45B,120C 'dom':5A,80C 'dom-bas':79C 'enabl':40B,108C 'escap':42B,118C 'execut':124C 'frontend':19B 'get':44B 'html':36B,102C 'ic':9A,89C 'ic-tree-item':8A,88C 'influenc':54B,111C 'intellig':67C 'item':11A,32B,57B,91C,98C,105C,114C 'javascript':20B,49B,126C 'kit':70C 'label':12A,33B,58B,115C 'markup':43B,119C 'packag':21B,27B 'pars':30B,95C 're':29B,94C 're-pars':28B,93C 'router':97C 'router-item':96C 'run':47B,60B 'script':61B,85C 'site':84C 'slot':99C 'text':34B,100C 'tree':10A,31B,56B,90C,104C,113C 'truncat':38B,106C 'truncatetreeitemlabel':122C 'ui':69C 'ukic':1A 'ukic/canary-web-components':26B,71C 'visitor':64B,128C 'vulner':86C 'web':3A,23B 'web-compon':22B 'xss':6A","nicknames":[],"mitigations":[],"who_affected":"Applications that use the @ukic/canary-web-components package in the 3.0.0-canary.12 to before 3.0.0-canary.48 range, with tree item truncation enabled and labels that an attacker can influence. Apps that do not use the canary package, or that never enable truncation on tree items, are less exposed.","tier":"C","verified":{},"analyst_revisit_at":null,"first_public_at":"2026-10-19T14:17:07+00:00","kev":null,"cvss_vector":"CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:P/VC:L/VI:L/VA:N/SC:L/SI:L/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","cvss_by":"disclosure@vulncheck.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-112290","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-112290","severity":null,"published_at":"2026-10-19T14:17:07+00:00","modified_at":"2026-10-19T21:13:39+00:00","first_seen_at":"2026-10-23T21:57:18+00:00","fetched_at":"2026-10-23T22:28:57+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}