GHSA-7cj5-v4pp-v632: LibreNMS: Stored XSS via graph_descr admin config settings echoed without escaping to all authenticated users

August 18, 2026

The graph_descr.<graphtype> family of settings is echoed verbatim without htmlspecialchars() in includes/html/pages/graphs.inc.php:194. Any admin can store a malicious HTML payload that executes in every authenticated user’s browser viewing that graph type.

References

github.com/advisories/GHSA-7cj5-v4pp-v632
github.com/librenms/librenms/releases/tag/26.7.0
github.com/librenms/librenms/security/advisories/GHSA-7cj5-v4pp-v632

Code Behaviors & Features

Detect and mitigate GHSA-7cj5-v4pp-v632 with GitLab Dependency Scanning

Secure your software supply chain by verifying that all open source dependencies used in your projects contain no disclosed vulnerabilities. Learn more about Dependency Scanning →