Is CVE-2026-112290 being exploited?

No public exploit is currently tracked.

How severe is CVE-2026-112290?

CVE-2026-112290 has a CVSS v3 severity of MEDIUM (4.7).

Back

CVE-2026-112290

Description

Intelligence Community UI Kit @ukic/canary-web-components 3.0.0-canary.12 before 3.0.0-canary.48 contains a DOM-based cross-site scripting vulnerability in ic-tree-item that re-parses router-item slot text as HTML. When tree item truncation is enabled, attackers who influence a tree item label can have escaped markup decoded by truncateTreeItemLabel() and executed as JavaScript in visitors' browsers.