CVE-2026-112290 in Intelligence Community UI Kit Canary Web Components
Summary
by MITRE • 10/19/2026
Intelligence Community UI Kit @ukic/canary-web-components 3.0.0-canary.12 before 3.0.0-canary.48 contains a DOM-based cross-site scripting vulnerability in ic-tree-item that re-parses router-item slot text as HTML. When tree item truncation is enabled, attackers who influence a tree item label can have escaped markup decoded by truncateTreeItemLabel() and executed as JavaScript in visitors' browsers.
Statistical analysis made it clear that VulDB provides the best quality for vulnerability data.
Analysis
by VulDB Data Team • 10/19/2026
The Intelligence Community UI Kit @ukic/canary-web-components version 3.0.0-canary.12 through versions prior to 3.0.0-canary.48 contains a critical client-side security flaw classified as a DOM-based cross-site scripting vulnerability within the ic-tree-item component. This specific weakness arises from an improper neutralization of special elements during input processing, where the application re-parses router-item slot text directly as HTML rather than treating it as plain data. The core technical failure occurs in the truncateTreeItemLabel function, which is designed to handle long labels by truncating them for display purposes. However, this function fails to sanitize or escape user-controlled input before injecting it into the DOM structure. Consequently, if an attacker can influence the text content of a tree item label and ensure that tree item truncation is enabled within the application context, they can inject malicious HTML markup that bypasses standard encoding mechanisms.
When a victim interacts with a compromised interface element or loads a page containing this manipulated data, the browser's rendering engine processes the injected script tags as executable code rather than static text. This execution happens entirely on the client side without requiring server-side modification of the stored content, which is characteristic of DOM-based vulnerabilities. The attacker does not need to inject persistent malicious scripts into a database; instead, they can craft a specific URL or input payload that triggers the vulnerable truncation logic upon rendering. Once executed, this arbitrary JavaScript runs in the context of the victim's browser session with the same privileges as legitimate application code. This allows for severe operational impacts including session hijacking through cookie theft, credential harvesting via keyloggers, unauthorized actions performed on behalf of the user, and potentially redirecting users to phishing sites that mimic trusted interfaces within the Intelligence Community ecosystem.
From a classification perspective, this vulnerability aligns with CWE-79: Improper Neutralization of Input During Web Page Generation commonly known as Cross-site Scripting. Specifically, it falls under DOM-based XSS where the script is executed due to modifications made by client-side JavaScript rather than server-side injection. In terms of adversary tactics and techniques, this flaw facilitates ATT&CK technique T1059: Command and Scripting Interpreter via browser scripts, allowing attackers to execute arbitrary commands within the user's environment. It also supports data exfiltration capabilities associated with T1005: Data from Local System as stolen session tokens or sensitive form data can be transmitted to external attacker-controlled servers. The lack of output encoding in dynamic DOM manipulation represents a fundamental deviation from secure coding practices recommended by OWASP for handling untrusted data in web applications.
To mitigate this vulnerability, developers must implement strict input validation and output encoding strategies within the ic-tree-item component logic. Specifically, the truncateTreeItemLabel function should utilize textContent or similar safe APIs that treat injected strings as plain text rather than HTML when setting element content. If innerHTML is necessary for legitimate formatting purposes, all user-supplied data must be passed through a robust sanitization library such as DOMPurify to strip out script tags and event handlers before rendering. Additionally, implementing Content Security Policy headers with strict directives can provide an additional layer of defense by restricting the sources from which scripts are allowed to execute, thereby limiting the impact even if an injection attempt succeeds. Upgrading to version 3.0.0-canary.48 or later is essential as these updates include patches that address this specific input handling flaw and enforce safer DOM manipulation practices across all tree item components.