Admin-context script execution via raw progress message

Reflected XSS in Snipe-IT 8.3.4 and earlier allows remote authenticated users to execute JavaScript through the CSV Import workflow. The Livewire update handler accepts a client-supplied progress_message and returns it to the admin interface, which renders the value as raw HTML without sanitization. Exploitation requires an authenticated administrator to intercept and alter that administrator's request; the supplier disputes that this self-directed scenario constitutes a vulnerability.