CVE-2026-112290: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') in MI6 Intelligence Community UI Kit canary web components

The Intelligence Community UI Kit @ukic/canary-web-components versions >=3.0.0-canary.12 and <3.0.0-canary.48 contain a DOM-based cross-site scripting vulnerability in the ic-tree-item component. This vulnerability arises because the router-item slot text is re-parsed as HTML, and when tree item truncation is enabled, the truncateTreeItemLabel() function decodes escaped markup. An attacker who can influence a tree item label can inject JavaScript that executes in the context of visitors' browsers, leading to potential XSS attacks. The CVSS 4.0 vector indicates network attack vector, high attack complexity, partial attack type, no privileges required, user interaction required, and low impact on confidentiality, integrity, and availability.

Successful exploitation allows an attacker who can control a tree item label to execute arbitrary JavaScript in the browsers of users viewing the affected component. This can lead to typical XSS impacts such as session hijacking or UI manipulation. However, the overall impact is rated low due to the complexity and partial attack requirements, as well as limited confidentiality, integrity, and availability impact.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. No official fix or patch information is provided in the input data. Users should monitor for vendor updates and apply any official patches when available. Until then, consider disabling tree item truncation or sanitizing input to tree item labels to reduce risk.