GHSA-86rg-8hc8-v82p

Suggest an improvement
Source
https://github.com/advisories/GHSA-86rg-8hc8-v82p
Import Source
https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2025/10/GHSA-86rg-8hc8-v82p/GHSA-86rg-8hc8-v82p.json
JSON Data
https://api.osv.dev/v1/vulns/GHSA-86rg-8hc8-v82p
Aliases
Published
2025-10-13T22:11:25Z
Modified
2025-10-14T01:25:14Z
Severity
  • 5.5 (Medium) CVSS_V4 - CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N/E:P CVSS Calculator
Summary
LibreNMS is vulnerable to Reflected-XSS in `report_this` function
Details

Summary

Reflected-XSS in report_this function in librenms/includes/functions.php

Details

Recently, it was discovered that the report_this function had improper filtering (htmlentities function was incorrectly used in a href environment), which caused the project_issues parameter to trigger an XSS vulnerability.

The Vulnerable Sink: https://github.com/librenms/librenms/blob/master/includes/functions.php#L444

PoC

GET project_issues=javascript:alert(document.cookie)

Impact

XSS vulnerabilities allow attackers to execute malicious scripts in users' browsers, enabling unauthorized access to sensitive data, session hijacking, or malware distribution.

Suggestion

It is recommended to filter dangerous protocols, e.g. javascript:/file:.

Database specific 
{
    "cwe_ids": [
        "CWE-79"
    ],
    "github_reviewed": true,
    "github_reviewed_at": "2025-10-13T22:11:25Z",
    "nvd_published_at": "2025-10-13T22:15:34Z",
    "severity": "MODERATE"
}
References

Affected packages

Packagist / librenms/librenms

Package

Name
librenms/librenms
Purl
pkg:composer/librenms/librenms

Affected ranges

Type
ECOSYSTEM
Events
Introduced
0 Unknown introduced version / All previous versions are affected
Fixed
25.7.0

Affected versions

1.*
1.19
1.20
1.20.1
1.21
1.22
1.22.01
1.23
1.24
1.25
1.26
1.27
1.28
1.29
1.30
1.30.01
1.31
1.31.01
1.31.02
1.31.03
1.32
1.32.01
1.33
1.33.01
1.34
1.35
1.36
1.36.01
1.37
1.38
1.39
1.40
1.41
1.42
1.42.01
1.43
1.44
1.45
1.46
1.47
1.48
1.48.1
1.49
1.50
1.50.1
1.51
1.52
1.53
1.53.1
1.54
1.55
1.56
1.57
1.58
1.58.1
1.59
1.60
1.61
1.62
1.62.1
1.62.2
1.63
1.64
1.64.1
1.65
1.65.1
1.66
1.67
1.68
1.69
1.70.0
1.70.1
21.*
21.1.0
21.2.0
21.3.0
21.4.0
21.5.0
21.5.1
21.6.0
21.7.0
21.8.0
21.9.0
21.9.1
21.10.0
21.10.1
21.10.2
21.11.0
21.12.0
21.12.1
22.*
22.1.0
22.2.0
22.2.1
22.2.2
22.3.0
22.4.0
22.4.1
22.5.0
22.6.0
22.7.0
22.8.0
22.9.0
22.10.0
22.11.0
22.12.0
23.*
23.1.0
23.1.1
23.2.0
23.4.0
23.4.1
23.5.0
23.6.0
23.7.0
23.8.0
23.8.1
23.8.2
23.9.0
23.9.1
23.10.0
23.11.0
24.*
24.1.0
24.2.0
24.3.0
24.4.0
24.4.1
24.5.0
24.6.0
24.7.0
24.8.0
24.8.1
24.9.0
24.9.1
24.10.0
24.10.1
24.11.0
24.12.0
25.*
25.1.0
25.2.0
25.3.0
25.4.0
25.5.0
25.6.0

Database specific

last_known_affected_version_range 
"<= 25.6.0"
source 
"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2025/10/GHSA-86rg-8hc8-v82p/GHSA-86rg-8hc8-v82p.json"