LibreNMS, a network monitoring system, is vulnerable to reflected cross‑site scripting through the instance and vmid GET parameters in the Proxmox application view. The parameters are placed into the page title using only strip_tags before string interpolation, allowing a malicious input containing a single quote to terminate the JavaScript string and inject arbitrary script. An attacker who lures an authenticated user to a crafted link can execute JavaScript in that user’s session, enabling theft of session data and other in‑browser attacks.

The vulnerability affects all releases of LibreNMS up to and including version 26.4.0. The affected product is LibreNMS from the librenms vendor. The issue was fixed in version 26.5.0.

The CVSS score of 5.4 indicates moderate severity. The EPSS score is not available and the vulnerability is not listed in CISA KEV, which suggests that no large‑scale exploitation has been reported yet. Attackers must socially engineer an authenticated user to click a specially crafted link containing malicious instance or vmid values. Successful exploitation would give the attacker the ability to run JavaScript within the victim’s browser context, potentially allowing session hijacking or unauthorized actions performed under the victim’s account.