Snipe‑IT allows users with component view access to create or edit a component’s notes. The notes field is concatenated into the page without escaping, which enables an attacker to embed HTML or JavaScript. When a victim views the component, the injected script runs in their browser, potentially compromising credential confidentiality and session integrity. The vulnerability is classified as a classic reflected XSS, mapping to CWE‑79.

The vulnerability affects the Snipe‑IT system developed by Grokability. All installations running any version prior to 8.4.1 are impacted; version 8.4.1 onward mitigates the flaw.

The CVSS score for this issue is 4.8, indicating a moderate threat. EPSS data is not available and the vulnerability is not listed in CISA’s KEV catalog. The likely attack vector is an authenticated user who can edit component notes; exploitation requires valid component view rights and the ability to supply arbitrary content to the notes field. Once injected, the payload executes in the victim’s browser context.