What is GHSA-pvwj-jwv3-68ww?

GHSA-pvwj-jwv3-68ww is a security advisory published by GitHub Security Advisories with Medium severity. LibreNMS versions \u003c= 26.4.0 contain a stored cross-site scripting vulnerability in the...

Which CVE IDs does GHSA-pvwj-jwv3-68ww cover?

GHSA-pvwj-jwv3-68ww covers the following CVE IDs: CVE-2026-84188. Each CVE has its own detail page on EchelonGraph Pulse with the synthesized EG score.

What is the CVSS v3 score of GHSA-pvwj-jwv3-68ww?

GHSA-pvwj-jwv3-68ww has a CVSS v3 base score of 4.8, published by GitHub Security Advisories.

GHSA-pvwj-jwv3-68wwMediumCVSS 4.8

LibreNMS versions <= 26.4.0 contain a stored cross-site scripting vulnerability in the...

Vendor

GitHub Security Advisories

Published

September 1, 2026

Last Modified

September 1, 2026

🔗 CVE IDs covered (1)

CVE-2026-84188 →

📋 Description

LibreNMS versions <= 26.4.0 contain a stored cross-site scripting vulnerability in the graph_descr. configuration settings, which are echoed verbatim without HTML escaping in includes/html/pages/graphs.inc.php. An administrator can store a malicious HTML payload that executes in the browser of any authenticated user who views the affected graph type. The issue is fixed in version 26.7.0.

🔗 References (4)

https://github.com/librenms/librenms/security/advisories/GHSA-7cj5-v4pp-v632
https://nvd.nist.gov/vuln/detail/CVE-2026-84188
https://www.vulncheck.com/advisories/librenms-before-26.7.0-stored-xss-via-graph-descr-settings
https://github.com/advisories/GHSA-pvwj-jwv3-68ww