GHSA-jmqm-f8q4-v7wx: XSS
Summary LegacyController.php:75 writes the page title into a document.title JS assignment using string interpolation. apps/proxmox.inc.php pushes $vars['instance'] and $vars['vmid'] (GET params, only striptags() applied) directly into $pagetitle. A single quote terminates the JS string, executing arbitrary script.
Details php // LegacyController.php:75 $html .= "<script>\ndocument.title = '$title';\n</script>";
// proxmox.inc.php:38,42 $pagetitle[] = $instance; // GET ?instance= $pagetitle[] = $vars['vmid']; // GET ?vmid=
PoC http://target/apps?app=proxmox&instance=%27%3Balert%28document.cookie%29%3B//
Confirmed in response: document.title = 'Apps - Proxmox - ';alert(document.cookie);// - LibreNMS';
Fix php // LegacyController.php:75 $html .= "<script>\ndocument.title = " . jsonencode($title) . ";\n</script>"; Also wrap $instance and $vars['vmid'] in htmlspecialchars() in proxmox.inc.php.
Prerequisite Any authenticated session. Victim must follow a crafted link.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
composer/librenms/librenmsto a version that resolves this vulnerability.Fixed in 26.5.0 - Configuration
In `apps/proxmox.inc.php`, HTML-encode (use `htmlspecialchars()`) for the GET-derived values `$instance` and `$vars['vmid']` before inserting them into `$pagetitle`, replacing the current handling where only `strip_tags()` is applied.
proxmox.inc.php Output encoding for $vars['instance'] and $vars['vmid'] = wrap $instance and $vars['vmid'] in htmlspecialchars() - Configuration
In `LegacyController.php` at the `document.title = '$title';` assignment site, ensure `$title` is properly encoded/escaped for JavaScript string context so a single quote in the page title cannot terminate the JS string and inject arbitrary script.
LegacyController.php document.title string construction = avoid unescaped single-quote interpolation
Event History
Frequently Asked Questions
What is the severity of GHSA-jmqm-f8q4-v7wx?
The severity of GHSA-jmqm-f8q4-v7wx is classified as medium with a score of 5.4.
What type of vulnerability is associated with GHSA-jmqm-f8q4-v7wx?
GHSA-jmqm-f8q4-v7wx is an XSS (Cross-Site Scripting) vulnerability.
How do I fix GHSA-jmqm-f8q4-v7wx?
To fix GHSA-jmqm-f8q4-v7wx, ensure that user input is properly sanitized and validated before being used in JavaScript assignments.
What is affected by GHSA-jmqm-f8q4-v7wx?
GHSA-jmqm-f8q4-v7wx affects the software package composer/librenms/librenms.
When was GHSA-jmqm-f8q4-v7wx published?
GHSA-jmqm-f8q4-v7wx was published on August 12, 2026.