CVE-2026-129358: Linux Foundation Magma NMS routes.ts handleReact cross site scripting
A vulnerability was identified in Linux Foundation Magma up to 1.9.0. Impacted is the function handleReact of the file nms/server/main/routes.ts of the component NMS. Such manipulation leads to cross site scripting. It is possible to launch the attack remotely. The exploit is publicly available and might be used. The vendor was contacted early about this disclosure but did not respond in any way.
Affected Software
Event History
Frequently Asked Questions
Which deployments should be considered potentially affected?
Linux Foundation Magma deployments up to version 1.9.0 that use the NMS component should be considered potentially affected. The affected code is identified as nms/server/main/routes.ts.
What level of access and interaction does exploitation require?
The supplied vector indicates that an attacker needs high privileges and user interaction is required. The attack can be launched remotely.
How likely is active exploitation?
A public exploit is available and may be used. This makes exposed, affected NMS deployments a priority for validation despite the low listed severity.