Skip to content
CVE PROGRAM SOURCE RECORD9.2 Critical

CVE-2026-84189

LibreNMS before 26.7.0 Stored XSS via Oxidized API

Read JSON ↗CVE.org ↗
Status
Published
Published
Updated
Assigning organization
VulnCheck

Description

LibreNMS through 26.4.0 renders JSON fields (name, ip, model, author, commit message) returned by the admin-configurable Oxidized integration URL (oxidized.url) into the device showconfig page without applying htmlspecialchars(). An administrator who points the Oxidized URL at an attacker-controlled server (SSRF) can cause it to return malicious JSON, resulting in stored/persistent cross-site scripting affecting all users who view any device's showconfig tab. Fixed in 26.7.0.

Affected products

Version statuses are supplied by the assigning organization. Consult the original record for detailed ranges and platform conditions.

librenms librenms

Default version status: unaffected

  • 0 to < 26.7.0affected
  • 26.7.0unaffected
pkg:composer/librenms/librenms

References