CVE Intelligence

MI6 Intelligence Community UI Kit canary web components vulnerabilities

🔔 Create alert RSS Version checker

Published CVEs affecting MI6 Intelligence Community UI Kit canary web components: 1 record(s), with affected versions and fixes.

CVE-2026-112290 Medium · 4.7 CWE-79 Oct 19, 2026
MI6 @ukic/canary-web-components 3.0.0-canary.12 before 3.0.0-canary.48 DOM XSS via ic-tree-item
Intelligence Community UI Kit @ukic/canary-web-components 3.0.0-canary.12 before 3.0.0-canary.48 contains a DOM-based cross-site scripting vulnerability in ic-tree-item that re-parses router-item slot text as HTML. When tree item truncation is enabled, attackers who influence a tree item label can have escaped markup decoded by truncateTreeItemLabel() and executed as JavaScript in visitors' browsers.