In LibreNMS before version 26.5.0, the Proxmox integration improperly handles the GET parameters 'instance' and 'vmid' by inserting them directly into a JavaScript assignment to document.title using string interpolation without adequate sanitization. Only strip_tags() is applied, which is insufficient to prevent injection of JavaScript code. An attacker can craft a URL with malicious payloads in these parameters that break out of the string context and execute arbitrary JavaScript in the victim's browser. The vulnerability requires the victim to be authenticated and to follow a malicious link. The recommended fix is to use json_encode() for the document.title assignment and to apply htmlspecialchars() to the GET parameters to ensure proper escaping.

Successful exploitation allows an attacker to execute arbitrary JavaScript in the context of the authenticated user's browser session. This can lead to theft of session cookies, user impersonation, or other actions permitted by the user's privileges within LibreNMS. The vulnerability does not impact availability and requires user interaction and an authenticated session.

A patch is available that changes the JavaScript assignment to use json_encode() for safe encoding of the page title and applies htmlspecialchars() to the 'instance' and 'vmid' GET parameters in proxmox.inc.php. Users should upgrade to LibreNMS version 26.5.0 or later where this fix is implemented. Until patched, avoid clicking on untrusted links containing Proxmox app parameters. No additional mitigations are specified by the vendor.