CVE-2021-31274
Description
In LibreNMS < 21.3.0, a stored XSS vulnerability was identified in the API Access page due to insufficient sanitization of the $api->description variable. As a result, arbitrary Javascript code can get executed.
AI Insight
LLM-synthesized narrative grounded in this CVE's description and references.
Affected packages
Versions sourced from the GitHub Security Advisory.
| Package | Affected versions | Patched versions |
|---|---|---|
librenms/librenmsPackagist | < 21.3.0 | 21.3.0 |
Affected products
2- LibreNMS/LibreNMSdescription
Patches
Vulnerability mechanics
Root cause
"Insufficient sanitization of the $api->description variable allows stored cross-site scripting."
Attack vector
An attacker must first be authenticated to the LibreNMS web interface. They navigate to the API Access page (`/api-access`), click "Create API access token", and enter malicious JavaScript in the "Descr:" (description) field [ref_id=1]. When the description is later displayed on the page, the unsanitized script executes in the browser of any user viewing the API Access page, leading to stored cross-site scripting [CWE-79].
Affected code
The vulnerability exists in the API Access page of LibreNMS. The `$api->description` variable is not properly sanitized before being rendered, allowing stored XSS [ref_id=1]. The fix was merged in pull request #12739 on the master branch [ref_id=1].
What the fix does
The advisory states the fix was merged into the master branch via pull request #12739 and was included in the stable release shortly after [ref_id=1]. While the exact diff is not shown in the advisory, the fix addresses the insufficient sanitization of the `$api->description` variable, ensuring user-controlled input is neutralized before being output in the web page [CWE-79]. Users should upgrade to LibreNMS version 21.3.0 or later.
Preconditions
- authAttacker must be authenticated to the LibreNMS web interface
- inputAttacker must have access to the API Access page to create or edit an API token description
Reproduction
Login to the website. Go to `[LibreNMS root URL]/api-access`. Click the "Create API access token" button. Enter `<script>alert(1)</script>` (or similar payload) in the "Descr:" field, and click "Create API Token" [ref_id=1].
Generated on May 27, 2026. Inputs: CWE entries + fix-commit diffs from this CVE's patches. Citations validated against bundle.
References
4- github.com/advisories/GHSA-2r2w-jrh2-p4grghsaADVISORY
- nvd.nist.gov/vuln/detail/CVE-2021-31274ghsaADVISORY
- community.librenms.org/t/vulnerability-report-cross-site-scripting-xss-in-the-api-access-page/15431ghsax_refsource_MISCWEB
- github.com/librenms/librenms/pull/12739ghsax_refsource_MISCWEB
News mentions
0No linked articles in our index yet.