snipe/snipe-it (packagist) has 81 known vulnerabilities, the worst rated CRITICAL. No single fixed version is recorded that clears every advisory, so check each one below. No malicious-package signal is recorded.
Insecure Permissions vulnerability in grokability snipe-it versions through 8.4.0, fixed after 2026-03-10 commit 676a9958, allow a remote attacker to execute…
CyberXYZ does not call a package safe in absolute terms. It records 81 known vulnerabilities for snipe/snipe-it (packagist), the worst rated CRITICAL, and no malicious-package signal. Whether it is acceptable depends on the version you run.
Does snipe/snipe-it have known vulnerabilities?
Yes. CyberXYZ records 81 known vulnerabilities for snipe/snipe-it (packagist), the worst rated CRITICAL. These include GHSA-xg82-2hrv-hf64, GHSA-396x-xmvh-p563, GHSA-hxcx-9h4f-42xx, GHSA-p9h3-gvpq-5539, GHSA-j5g3-42wp-gqm3.
How do I check snipe/snipe-it before installing?
Search snipe/snipe-it in CyberXYZ Check at https://cyberxyz.io/check?q=snipe%2Fsnipe-it. The xyz Scanner checks a project's dependencies, and CyberXYZ Proxy checks each package as it is installed.
Checked 2026-11-14 at 11:45 UTC. The most recent advisory here was published 2026-09-24. Updated continuously from NVD, GHSA, OSV and CNA feeds.