Executive brief
LibreNMS is network monitoring and management software that collects data from network devices via SNMP. This vulnerability allows an attacker controlling a monitored device to inject malicious JavaScript into VRF (Virtual Routing and Forwarding) configuration fields, which then executes in the browsers of any LibreNMS user viewing those pages. An attacker could steal administrator session cookies, create unauthorized accounts, or gather sensitive network information from the monitoring system.
Technical details
This is a stored cross-site scripting (XSS) vulnerability in LibreNMS's VRF display functionality. The mplsVpnVrfDescription, vrf_name, and mplsVpnVrfRouteDistinguisher fields are collected from SNMP responses during device discovery and stored in the database without sanitization. When displayed on VRF pages in includes/html/print-vrf.inc.php and includes/html/pages/routing/vrf.inc.php, these fields are echoed directly into HTML and JavaScript contexts without htmlspecialchars() or htmlentities() escaping. An attacker with control of a monitored network device (or via MITM on SNMPv1/v2c) can inject arbitrary JavaScript through SNMP responses; the payload persists in the database and executes whenever any authenticated user views VRF pages. Patch: upgrade to LibreNMS 26.5.0 or later.
Affected products
- LibreNMS LibreNMS before 26.5.0
Timeline
- 2026-08-04: disclosed
- 2026-26.5.: patched: Patched in version 26.5.0