DOM-based cross-site scripting in MI6 canary web components tree items
Key facts
- Attack vector
- Network
- Privileges required
- None
- User interaction
- Passive
- Attack complexity
- High
- Attack requirements
- Present
- Impact type
- Cross-site scripting
- Confidentiality · integrity · availability
- Low · Low · None
- Fix status
- Fixed
Attack profile from CVSS 4.0 · CNA. Fix status from CNA. Impact type from CWE-79.
Summary
The MI6 Intelligence Community UI Kit package @ukic/canary-web-components from 3.0.0-canary.12 before 3.0.0-canary.48 contains a DOM-based cross-site scripting flaw in ic-tree-item (CWE-79). The component re-parses router-item slot text as HTML, so escaped markup is decoded and run as JavaScript when tree item truncation is enabled. An attacker who can influence a tree item label needs a visitor to interact with the page to run script in that visitor's browser.
Written with Claude Haiku 5.5 from the sources below · 2026-10-28
Description from the CNA
Intelligence Community UI Kit @ukic/canary-web-components 3.0.0-canary.12 before 3.0.0-canary.48 contains a DOM-based cross-site scripting vulnerability in ic-tree-item that re-parses router-item slot text as HTML. When tree item truncation is enabled, attackers who influence a tree item label can have escaped markup decoded by truncateTreeItemLabel() and executed as JavaScript in visitors' browsers.
Why it matters now
SSVC decision points
CISA ADP · SSVC 2.0.3
- Exploitation
- None
- Automatable
- No
- Technical impact
- Partial
The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| MI6 | Intelligence Community UI Kit canary web components | 3.0.0-canary.12 to before 3.0.0-canary.48 | 3.0.0-canary.48 | Patch available | CNA |
- Intelligence Community UI Kit canary web components VendorMI6 Affected 3.0.0-canary.12 to before 3.0.0-canary.48 Fixed in 3.0.0-canary.48 Patch available CNA
Remediation
Update @ukic/canary-web-components to version 3.0.0-canary.48, the fixed version listed for MI6 Intelligence Community UI Kit canary web components.
Written with Claude Haiku 5.5 from the sources below · 2026-10-28
- Fix · CNA Intelligence Community UI Kit canary web components (MI6) Fixed in 3.0.0-canary.48
Timeline
- 2026-10-19 Threatist record created from CVE-2026-112290
- 2026-10-19 Alias added: GHSA-w4jm-jj2f-69q8
References
Sources
- CVE-2026-112290 · CVE Program
- CVE-2026-112290 · NVD
- FIRST EPSS
- GHSA-w4jm-jj2f-69q8 · GitHub Advisory Database · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences