GHSA-r42m-953q-6vjx
Snipe-IT has Stored XSS via Component Checkout Notes (v8.4.0)
Packages
| Ecosystem | Package | Affected | Fixed in |
|---|---|---|---|
| Packagist | snipe/snipe-it | < 8.4.1 | 8.4.1 |
Details
As written in the advisory (Markdown source, shown as plain text).
### Impact
Users with component view access could be impacted by an unescaped `notes` column.
### Patches
This was patched in https://github.com/grokability/snipe-it/commit/28f493d84d057895fbb93b6570e7393a2c2fa438, and is fixed in v8.4.1 or greater.
### Workarounds
None.
References
External links from the advisory. They lead to third-party sites.