CVE-2026-86738

Snipe-IT versions before 8.7.0 contain a CSS injection flaw (CWE-79) in the Custom CSS field, where sanitization HTML-encodes greater-than and double-quote characters but then reverses that encoding, allowing crafted CSS containing those characters to pass through unescaped. A superuser can plant a payload built from @import and url() references combined with attribute-selector rules; when other superusers load the application, the injected CSS silently sends their CSRF tokens to attacker-controlled servers. With a stolen CSRF token, the attacker can perform cross-site request forgery actions against the victim's session, achieving takeover of other superuser accounts. Any organization running Snipe-IT prior to 8.7.0 is affected, with risk concentrated in instances that have multiple superusers, one of which is malicious or compromised. Despite a critical 9.3 CVSS 4.0 score, exploitation is currently unknown: there is no public proof-of-concept, no CISA KEV listing, and EPSS estimates only a 0.3% probability of exploitation within 30 days.

What to do: Upgrade to Snipe-IT 8.7.0 or later, which fixes the Custom CSS sanitization. Until then, audit the Custom CSS field for unexpected @import, url(), or attribute-selector payloads, restrict superuser accounts to trusted administrators, and consider limiting outbound network access from the Snipe-IT server to block token exfiltration. Deployments with only a single superuser have little practical exposure unless that account itself is compromised.