CVE-2026-112290

The Intelligence Community UI Kit (@ukic/canary-web-components) versions 3.0.0-canary.12 before 3.0.0-canary.48 are vulnerable to a DOM-based cross-site scripting (XSS) vulnerability in the ic-tree-item component. The root cause is that the component re-parses router-item slot text as HTML. Speci...