What is GHSA-3cvh-rhc6-7rhc?

GHSA-3cvh-rhc6-7rhc is a security advisory published by GitHub Security Advisories with Medium severity. LibreNMS before 26.5.0 contains stored cross-site scripting vulnerabilities in VRF display pages...

Which CVE IDs does GHSA-3cvh-rhc6-7rhc cover?

GHSA-3cvh-rhc6-7rhc covers the following CVE IDs: CVE-2026-84191. Each CVE has its own detail page on EchelonGraph Pulse with the synthesized EG score.

What is the CVSS v3 score of GHSA-3cvh-rhc6-7rhc?

GHSA-3cvh-rhc6-7rhc has a CVSS v3 base score of 6.1, published by GitHub Security Advisories.

GHSA-3cvh-rhc6-7rhcMediumCVSS 6.1

LibreNMS before 26.5.0 contains stored cross-site scripting vulnerabilities in VRF display pages...

Vendor

GitHub Security Advisories

Published

September 1, 2026

Last Modified

September 1, 2026

🔗 CVE IDs covered (1)

CVE-2026-84191 →

📋 Description

LibreNMS before 26.5.0 contains stored cross-site scripting vulnerabilities in VRF display pages where mplsVpnVrfDescription, vrf_name, and mplsVpnVrfRouteDistinguisher fields from SNMP polling are rendered without sanitization. Attackers controlling a monitored network device can inject arbitrary JavaScript through SNMP responses that executes in the browser of any user viewing VRF-related pages.

🔗 References (4)

https://github.com/librenms/librenms/security/advisories/GHSA-g993-wffj-m3gv
https://nvd.nist.gov/vuln/detail/CVE-2026-84191
https://www.vulncheck.com/advisories/librenms-before-26.5.0-stored-xss-via-snmp-vrf-fields
https://github.com/advisories/GHSA-3cvh-rhc6-7rhc