GHSA-7gww-x7fh-jf9j: LibreNMS: SSRF-driven stored XSS via Oxidized API response fields in device showconfig page

The Oxidized integration URL (oxidized.url) is admin-configurable. LibreNMS fetches device info and version history from that URL and renders JSON fields (name, ip, model, author, commit message) into HTML without htmlspecialchars(). An admin pointing the URL at an attacker-controlled server achieves persistent XSS affecting all users who view any device’s showconfig tab.