VYPR
Get started
← All advisories
Moderate severityNVD Advisory· Published Feb 20, 2026· Updated Feb 20, 2026

LibreNMS affected by reflected XSS via email field

CVE-2026-26987

Description

LibreNMS is an auto-discovering PHP/MySQL/SNMP based network monitoring tool. Versions 25.12.0 and below are vulnerable to Reflected XSS attacks via email field. This issue has been fixed in version 26.2.0.

Affected packages

Versions sourced from the GitHub Security Advisory.

PackageAffected versionsPatched versions
librenms/librenmsPackagist
< 26.2.026.2.0

Affected products

1

Patches

1
8e626b38ef92

Fix reflected XSS (#19038)

https://github.com/librenms/librenmsTony MurrayFeb 16, 2026via ghsa
commit
7 files changed · +935 −1094
  • html/build/assets/app-B9-HHf45.js+328 −0 added
  • html/build/assets/app-BPd4hCLC.css+1 −0 added
  • html/build/assets/app-BRNotyG6.js+0 −328 removed
  • html/build/assets/app-DvSW9BmM.css+0 −1 removed
  • html/build/manifest.json+2 −2 modified
    @@ -20,12 +20,12 @@
     "src": "html/fonts/glyphicons-halflings-regular.woff2"
   },
   "resources/js/app.js": {
-    "file": "assets/app-BRNotyG6.js",
+    "file": "assets/app-B9-HHf45.js",
     "name": "app",
     "src": "resources/js/app.js",
     "isEntry": true,
     "css": [
-      "assets/app-DvSW9BmM.css"
+      "assets/app-BPd4hCLC.css"
     ],
     "assets": [
       "assets/glyphicons-halflings-regular-BUJKDMgK.eot",
  • package-lock.json+600 −761 modified
  • resources/js/components/LibrenmsSetting.vue+4 −2 modified
    @@ -51,7 +51,7 @@
 </template>
 
 <script>
-import _ from 'lodash';
+import _ from "lodash";
 
 export default {
         name: "LibrenmsSetting",
@@ -81,7 +81,9 @@ export default {
                     .catch((error) => {
                         this.feedback = 'has-error';
                         this.updateStatus = 'error';
-                        toastr.error(error.response.data.message);
+                        let span = document.createElement('span');
+                        span.textContent = error.response.data.message;
+                        toastr.error(span);
 
                         // don't reset certain types back to actual value on error
                         const ignore = [

Vulnerability mechanics

Generated by null/stub on May 9, 2026. Inputs: CWE entries + fix-commit diffs from this CVE's patches. Citations validated against bundle.

References

6

News mentions

0

No linked articles in our index yet.