LibreNMS, an auto‑discovery network monitoring tool, stores the value of the unit field in a Custom OID without applying strip_tags() or HTML escaping. The stored value is later rendered on web pages, so an attacker who can inject a crafted unit string can cause arbitrary JavaScript to execute in the browsers of any user who views the page, leading to cookie theft, session hijacking, or further client‑side attacks.

Versions 24.10.0 through 26.1.1 of the Librenms application are affected. The vulnerability is limited to the Librenms:Librenms product line and is resolved in release 26.2.0.

The CVSS score of 5.4 indicates a moderate severity, and the EPSS score of less than 1% suggests a low probability of being actively exploited. The vulnerability is not listed in the CISA KEV catalog. Exploitation requires the ability to create or edit a Custom OID via the web interface, a privilege normally granted to highly trusted administrators. Once a malicious unit value is stored, any user who views the corresponding page will have the script executed in their browser. The impact is confined to the affected users’ browsers, but the attack can be amplified if social engineering is used to lure other users to the compromised page.