Technical impact
This vulnerability located in the Magma NMS component’s handleReact function allows injection of arbitrary JavaScript into the web interface. The flaw arises from insufficient sanitization of user input, as indicated by CWE‑79 and CWE‑94 identifiers. An attacker can embed crafted scripts that execute within a victim’s browser when the NMS route is accessed. The impact is the execution of client‑side code, which can potentially read or modify page content, report data to the attacker, or perform actions in the context of the authenticated session.
Affected Systems
Linux Foundation Magma Network Management System versions 1.9.0 and earlier contain the vulnerable code in nms/server/main/routes.ts. All deployments using these versions are affected, regardless of the operating environment or network configuration. The problem is limited to the NMS component; other modules are not impacted.
Risk and Exploitability
The vulnerability has a CVSS score of 4.8, indicating moderate severity, while an EPSS score is unavailable and the vulnerability is not listed in CISA KEV. Attackers can reach the vulnerable endpoint remotely and trigger the XSS payload via a crafted URL or POST request. Because it is a reflected XSS mutation, exploitation requires that the victim visit a malicious location. No active exploitation evidence is present, but the public demonstration indicates a potential risk.
