LibreNMS before 26.9.0 contains a stored cross-site scripting vulnerability in get_oxidized_nodes_list() that renders Oxidized API fields and SNMP… (CVE-2026-109355)

The vulnerability in LibreNMS prior to version 26.9.0 is a stored cross-site scripting issue located in the get_oxidized_nodes_list() function. It occurs because Oxidized API fields and SNMP sysName values are rendered without proper escaping. An attacker who can control the Oxidized API response or a device's SNMP sysName can inject malicious JavaScript code. This code executes in the context of the browser for users accessing the Tools Oxidized page, potentially compromising user sessions or performing other malicious actions within the user's browser.

Successful exploitation allows attackers to execute arbitrary scripts in the browsers of users viewing the affected page, which can lead to information disclosure, session hijacking, or other client-side attacks. The vulnerability does not directly impact server availability or integrity but poses a risk to user confidentiality and integrity.

A fix is available in LibreNMS version 26.9.0. Users should upgrade to version 26.9.0 or later to remediate this vulnerability. No additional mitigations are specified in the advisory.