What is GHSA-m63v-9j9m-6j88?

GHSA-m63v-9j9m-6j88 is a security advisory published by GitHub Security Advisories with Medium severity. LibreNMS before 26.9.0 contains a stored cross-site scripting vulnerability in...

Which CVE IDs does GHSA-m63v-9j9m-6j88 cover?

GHSA-m63v-9j9m-6j88 covers the following CVE IDs: CVE-2026-109355. Each CVE has its own detail page on EchelonGraph Pulse with the synthesized EG score.

What is the CVSS v3 score of GHSA-m63v-9j9m-6j88?

GHSA-m63v-9j9m-6j88 has a CVSS v3 base score of 6.1, published by GitHub Security Advisories.

GHSA-m63v-9j9m-6j88MediumCVSS 6.1

LibreNMS before 26.9.0 contains a stored cross-site scripting vulnerability in...

Vendor

GitHub Security Advisories

Published

October 12, 2026

Last Modified

October 12, 2026

🔗 CVE IDs covered (1)

CVE-2026-109355 →

📋 Description

LibreNMS before 26.9.0 contains a stored cross-site scripting vulnerability in get_oxidized_nodes_list() that renders Oxidized API fields and SNMP sysName unescaped. Attackers controlling the Oxidized response or a device's SNMP sysName can inject script that executes in browsers of users viewing the Tools Oxidized page.

🔗 References (4)

https://github.com/librenms/librenms/security/advisories/GHSA-cjqw-76mh-jmpv
https://nvd.nist.gov/vuln/detail/CVE-2026-109355
https://www.vulncheck.com/advisories/librenms-before-26.9.0-stored-xss-via-tools-oxidized-node-list
https://github.com/advisories/GHSA-m63v-9j9m-6j88