LibreNMS stores the device group name on the server with no HTML escaping. An administrator who creates or edits a device group can inject arbitrary JavaScript that is then rendered when the group list is viewed by any logged‑in user. The stored XSS can be leveraged for session hijacking, credential theft, or in‑browser code execution, potentially allowing a privileged attacker to compromise other users’ sessions and access sensitive network information.

The vulnerability exists in LibreNMS 26.1.1 and earlier releases. All installations of the LibreNMS monitoring platform that have not applied the 26.2.0 update are affected.

The CVSS score of 5.1 indicates moderate severity. The EPSS score of less than 1% suggests that exploit prevalence is low, and the vulnerability is not listed in CISA’s KEV catalog, meaning no known widespread exploitation. The attack requires administrative credentials to create a device group, and the malicious payload is stored and served back to any user who views the group list. Successful exploitation requires an authenticated session with administrative rights and relies on the web UI’s rendering of the unsanitized name field.