LibreNMS through 26.4.0 renders JSON fields (name, ip, model, author, commit message) returned by the admin-configurable Oxidized integration URL… (CVE-2026-84189)

LibreNMS through version 26.4.0 improperly renders JSON fields (name, ip, model, author, commit message) from the Oxidized integration URL into the device showconfig page without applying htmlspecialchars(), leading to stored/persistent cross-site scripting (CWE-79). An administrator can exploit this by setting the Oxidized URL to an attacker-controlled server, which returns malicious JSON. This results in stored XSS affecting all users who view any device's showconfig tab. The issue is fixed in LibreNMS 26.7.0.

Successful exploitation allows an attacker to execute arbitrary scripts in the context of the LibreNMS web interface for any user viewing the device showconfig page. This can lead to session hijacking, credential theft, or other actions within the user's browser session. The vulnerability requires administrator privileges to configure the malicious Oxidized URL, but affects all users who view the affected page.

Upgrade LibreNMS to version 26.7.0 or later, where this vulnerability is fixed. Until then, administrators should avoid configuring the Oxidized integration URL to untrusted or attacker-controlled servers. No other mitigations are specified.