{"answers":{"affected":"2 open source packages ship an affected version, including librenms/librenms.","exploited":"There is no known exploitation of CVE-2026-45694 in the wild and no public exploit code.","fix":"Upgrade librenms/librenms to 26.5.0 or later.","what":"CVE-2026-45694 is a medium-severity cross-site scripting vulnerability in librenms, published on 26 Aug 2026. Any signed-in user can exploit it over the network, and only if a user opens a file or follows a link."},"fix_prompt":"Check this codebase for CVE-2026-45694 and fix it if it is affected.\n\nWhat it is: CVE-2026-45694 is a medium-severity cross-site scripting vulnerability in librenms, published on 26 Aug 2026. Any signed-in user can exploit it over the network, and only if a user opens a file or follows a link.\nExploitation: There is no known exploitation of CVE-2026-45694 in the wild and no public exploit code.\n\nAffected packages and fixed versions:\n- librenms/librenms (Packagist): affected all versions; fixed in 26.5.0\n- librenms/librenms (Packagist): affected all versions; fixed in 26.5.0\n\nTask:\n1. Search the dependency manifests and lockfiles (for example package.json, package-lock.json, requirements.txt, poetry.lock, uv.lock, pom.xml, build.gradle, go.mod, Cargo.lock, Gemfile.lock) and any Dockerfiles for the affected packages, including transitive dependencies.\n2. If an affected version is in use, upgrade it to the fixed version for its release line with the project's package manager, so the lockfile is regenerated. Prefer the smallest upgrade that fixes it.\n3. If there is no fix, or the upgrade would break the build, do not guess: explain the risk and the safest workaround instead.\n4. Run the tests and summarise what changed and why.\n5. If nothing in the project is affected, say so and change nothing.\n\nReference: https://insights.sbomify.com/CVE-2026-45694/ (Markdown: https://insights.sbomify.com/CVE-2026-45694/index.md)","id":"CVE-2026-45694","markdown":"https://insights.sbomify.com/CVE-2026-45694/index.md","name":"CVE-2026-45694","record":{"aliases":["GHSA-jmqm-f8q4-v7wx"],"analysis":{"component_type":"web_application","fix_type":"upgrade","impacts":["account_takeover","data_read"],"network_reachable":"yes","non_default_config":false,"product_category":"Network monitoring system","requires_auth":"low_privilege","summary":"Reflected XSS in LibreNMS allows attackers to execute scripts in authenticated users' sessions via crafted links, potentially stealing session data.","user_interaction":"required","vuln_class":"xss"},"analysis_generated_by":"qwen3.8-flash-next","assigner":"GitHub_M","cpe":[],"cvss":{"score":5.4,"severity":"medium","source":"cna","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N","version":"3.1"},"cwes":[{"id":"CWE-79","name":"Improper Neutralization of Input During Web Page Generation"}],"description":"LibreNMS is a network monitoring system. In versions up to and including 26.4.0, the Proxmox application view is vulnerable to reflected cross-site scripting through the user-supplied instance and vmid GET parameters, which are reflected into the page title without adequate encoding. The parameters are placed into the page title with only strip_tags applied, and the title is then written into an inline document.title assignment through string interpolation, so a single quote terminates the JavaScript string and the remaining input runs as script. An attacker who lures an authenticated user into following a crafted link can execute script in that user's session, enabling actions such as theft of session data. This issue is fixed in version 26.5.0.","ecosystems":["Packagist"],"exploits":{"exploitdb":0,"first_seen":null,"github_poc":0,"max_poc_stars":null,"metasploit":0,"nuclei":0,"refs":[],"tier":"none_known"},"has_fix":true,"headline":"LibreNMS: Reflected XSS in the Proxmox app view via unsanitized instance/vmid parameters","id":"CVE-2026-45694","indexable":true,"kev":null,"kind":"cve","links":{"ecosystem":"Packagist","product":null,"products":[],"type":"xss","year":"2026"},"n_packages":2,"n_references":2,"next":{"headline":"Kopia: Unauthenticated RCE via SSH ProxyCommand Injection when --insecure --without-password is used","id":"CVE-2026-45695"},"packages":[{"ecosystem":"Packagist","fixed":["26.5.0"],"introduced":["0"],"last_affected":[],"package":"librenms/librenms","purl":null,"source":"GHSA-jmqm-f8q4-v7wx"},{"ecosystem":"Packagist","fixed":["26.5.0"],"introduced":["0"],"last_affected":[],"package":"librenms/librenms","purl":"pkg:composer/librenms/librenms","source":"GHSA-jmqm-f8q4-v7wx"}],"prev":{"headline":"Caddy: Remote Admin Authorization Bypass in `/config` API via Array Index Normalization","id":"CVE-2026-45692"},"products":["librenms"],"published":"2026-08-26","related":[],"sources":[{"class":"attribution","licence":"CVE Terms of Use (MITRE)","name":"CVE List","prefix":"CVE"},{"class":"attribution","licence":"CC BY 4.0","name":"GitHub Advisory Database","prefix":"GHSA"},{"class":"attribution","licence":"CWE Terms of Use","name":"CWE (MITRE)"},{"class":"attribution","licence":"FIRST CVSS licence","name":"CVSS (FIRST)"}],"ssvc":{"automatable":"no","exploitation":"none","technical_impact":"partial"},"state":"PUBLISHED","updated":"2026-08-27","vendors":["librenms"]},"summary":"Reflected XSS in LibreNMS allows attackers to execute scripts in authenticated users' sessions via crafted links, potentially stealing session data.","url":"https://insights.sbomify.com/CVE-2026-45694/"}