Snipe-IT versions prior to 8.6.2 contain a stored XSS vulnerability due to improper neutralization of input in the manufacturer or supplier name fields. These names are used as the data-selected-count-id attribute in a Blade template, then read client-side and concatenated into HTML passed to jQuery's .after() method without sufficient sanitization. An attacker can craft a malicious name that executes JavaScript when viewed by an authenticated user on the manufacturer or supplier detail pages. This could expose data or allow actions available to that user's session. The vulnerability is fixed in version 8.6.2.

An attacker who can supply a malicious manufacturer or supplier name can execute arbitrary JavaScript in the browser of an authenticated user viewing the affected pages. This can lead to exposure of sensitive data or unauthorized actions within the context of the victim's session. The CVSS 4.0 base score is 6.3 (medium severity), reflecting network attack vector, low attack complexity, no privileges required but user interaction needed, and limited confidentiality and integrity impact with high scope and availability impact.

This vulnerability is fixed in Snipe-IT version 8.6.2. Users should upgrade to version 8.6.2 or later to remediate this issue. No official patch or temporary workaround is provided in the advisory data. Until upgrading, avoid viewing untrusted manufacturer or supplier names in the application to reduce risk.