Intelligence Community UI Kit canary web components contain a DOM‑based cross‑site scripting flaw in the ic‑tree‑item component. The vulnerability arises when the component re‑parses the router‑item slot text as HTML. When truncation of the tree item label is enabled, attacker supplied labels can be unescaped by truncateTreeItemLabel() and then executed as JavaScript in the victim’s browser. This grants the attacker the ability to run arbitrary scripts in the context of the site, potentially leading to session hijacking, data exfiltration, or other client‑side attacks.

The affected product is MI6 Intelligence Community UI Kit canary web components. Vulnerable versions are 3.0.0‑canary.12 through 3.0.0‑canary.47 inclusive; the flaw is fixed in 3.0.0‑canary.48 and later.

The CVSS score of 2.3 rates the vulnerability as low severity, and the EPSS score is not available. It is not listed in the CISA KEV catalog. Exploitation requires the ability to influence the label of a tree item on a page that uses the component, a condition that is typically satisfied only when an attacker can inject content into the page. While the impact is limited to the browser of visitors who view the vulnerable component, the low score reflects the constraint that the flaw cannot be leveraged to escape the page or persist beyond the session without additional social‑engineering tactics.