LibreNMS versions earlier than 26.9.0 contain a stored cross‑site scripting flaw in the get_oxidized_nodes_list() routine that fails to escape data returned from the Oxidized API and SNMP sysName fields. An attacker who can control the Oxidized response or tamper with a device’s SNMP sysName may inject arbitrary JavaScript that runs in the browser of any user who visits the Tools → Oxidized page. This flaw permits arbitrary JavaScript execution in the browsers of users who view the page.

The vulnerability affects the LibreNMS monitoring platform. All installations using any release prior to 26.9.0 are vulnerable. No details are provided about operating systems or deployment size, but any environment running the affected version is at risk.

The exploit requires an attacker to supply a crafted Oxidized API response or manipulate SNMP sysName, which may be possible if the attacker has network access to the Oxidized service or the target device. The CVSS score of 5.3 indicates moderate overall risk, and the lack of an EPSS score and absence from the KEV catalog suggest limited publicly known exploits. Nevertheless, because the vulnerability is client‑side and can act purely once a user opens the Tools page, organizations should treat it as a moderate‑to‑high priority threat if users routinely access the page.