CVE-2026-109355: LibreNMS before 26.9.0 Stored XSS via Tools Oxidized Node List
LibreNMS before 26.9.0 contains a stored cross-site scripting vulnerability in getoxidizednodeslist() that renders Oxidized API fields and SNMP sysName unescaped. Attackers controlling the Oxidized response or a device's SNMP sysName can inject script that executes in browsers of users viewing the Tools Oxidized page.
Affected Software
Event History
Frequently Asked Questions
Who is exposed to this issue?
LibreNMS deployments before 26.9.0 are exposed when users view the Tools Oxidized page and an attacker can control fields returned by the Oxidized API or a monitored device's SNMP sysName.
What access does an attacker need to exploit it?
The attacker does not need LibreNMS credentials to supply the payload, but must be able to influence an Oxidized API response or the SNMP sysName of a device. A LibreNMS user must then open the Tools Oxidized page for the script to execute.
How can I determine whether my deployment may be affected?
Check whether the LibreNMS version is earlier than 26.9.0 and whether the deployment uses the Tools Oxidized page. Review whether Oxidized response data or monitored devices' SNMP sysName values can be controlled by untrusted parties.