MI6 vulnerabilities

🔔 Create alert RSS

Published CVEs affecting MI6 products: 1 record(s), with severity, exploitation and fixes.

Intelligence Community UI Kit canary web components 1

Exploited only (KEV) →

CVE-2026-112290 Medium · 4.7 CWE-79 Oct 19, 2026

MI6 @ukic/canary-web-components 3.0.0-canary.12 before 3.0.0-canary.48 DOM XSS via ic-tree-item

Intelligence Community UI Kit @ukic/canary-web-components 3.0.0-canary.12 before 3.0.0-canary.48 contains a DOM-based cross-site scripting vulnerability in ic-tree-item that re-parses router-item slot text as HTML. When tree item truncation is enabled, attackers who influence a tree item label can have escaped markup decoded by truncateTreeItemLabel() and executed as JavaScript in visitors' browsers.