How severe is GHSA-c89f-8g7g-59wj?

GHSA-c89f-8g7g-59wj has a CVSS score of 4.3/10, rated MEDIUM. Review your exposure and patch according to your risk tolerance.

Which packages are affected by GHSA-c89f-8g7g-59wj?

GHSA-c89f-8g7g-59wj affects the following packages: librenms/librenms (Packagist). Ecosystems affected: Packagist.

How do I fix GHSA-c89f-8g7g-59wj?

Update librenms/librenms to 25.12.0 or later, then make sure no transitive (indirect) dependency still pins the vulnerable range — O3 confirms GHSA-c89f-8g7g-59wj is resolved across your whole dependency graph.

How do I detect GHSA-c89f-8g7g-59wj in my Packagist dependencies?

Scan your dependency tree (package-lock.json, pnpm-lock.yaml, requirements.txt, go.sum, etc.) for librenms/librenms. O3's reachability analysis confirms whether the vulnerable code path is actually invoked in your application, so you act on real exposure instead of every transitive match.

How do I mitigate GHSA-c89f-8g7g-59wj if there is no patch (or I can't update yet)?

If you can't upgrade right away: gate or disable the affected feature, validate untrusted input at the boundary, and avoid passing attacker-controlled data into the vulnerable path. O3's runtime protection blocks exploitation in production as an interim safeguard until the upgrade lands.

How does O3 Security protect against GHSA-c89f-8g7g-59wj?

O3 pinpoints whether GHSA-c89f-8g7g-59wj is reachable in your code and exactly where to fix it, then blocks exploitation in production at runtime until the patched version is deployed.

Is GHSA-c89f-8g7g-59wj actively exploited in the wild?

No public exploit code has been indexed for GHSA-c89f-8g7g-59wj yet. This does not mean the vulnerability cannot be exploited — absence of public exploits does not imply safety. Apply the recommended fix and use O3 Security to monitor your exposure.

What is the EPSS score for GHSA-c89f-8g7g-59wj?

GHSA-c89f-8g7g-59wj has an EPSS (Exploit Prediction Scoring System) score of 3.4%, placing it in the 87th percentile of all CVEs. EPSS is maintained by FIRST.org and estimates the probability that a vulnerability will be exploited in the wild within the next 30 days. This score indicates relatively lower exploitation probability, though the CVSS severity should still guide your patching priority.

What type of vulnerability is GHSA-c89f-8g7g-59wj?

GHSA-c89f-8g7g-59wj is classified as Cross-site Scripting (XSS) (CWE-79). This weakness type describe the underlying flaw category, which helps determine the potential impact and the right class of mitigation. This is a high-impact weakness class that often enables remote code execution or data exposure.

When was GHSA-c89f-8g7g-59wj published, and has it been updated?

GHSA-c89f-8g7g-59wj was published on December 23, 2025 and was last updated on December 23, 2025. Advisory data evolves as severity scores, affected ranges, and exploit intelligence are revised — always check the latest version of the advisory before acting.

🐘 Packagist

GHSA-c89f-8g7g-59wj

MEDIUM

LibreNMS Alert Rule API Cross-Site Scripting Vulnerability

Also known asCVE-2025-68614

Published

Dec 23, 2025

Updated

Dec 23, 2025

Affected

1 pkg

Patched

1 / 1

Exploits

None indexed

EPSS Exploitation Probability

via FIRST.org ↗

3.4%probability of exploitation in next 30 days

Lower Risk87th percentile+3.42%

EPSS (Exploit Prediction Scoring System) is a daily probability model maintained by FIRST.org. It estimates the likelihood a CVE will be exploited in production environments within the next 30 days, derived from real-world threat intelligence signals.

Blast Radius

1 pkg affected

🐘librenms/librenms

Real-time download stats are indexed for npm and PyPI packages. This vulnerability affects Packagist packages — download data is not available via public APIs for these ecosystems.

Description

Please find POC file here https://trendmicro-my.sharepoint.com/:u:/p/kholoud_altookhy/IQCfcnOE5ykQSb6Fm-HFI872AZ_zeIJxU-3aDk0jh_eX_NE?e=zkN76d

ZDI-CAN-28575: LibreNMS Alert Rule API Cross-Site Scripting Vulnerability

-- CVSS -----------------------------------------

4.3: AV:N/AC:L/PR:H/UI:R/S:U/C:L/I:L/A:L

-- ABSTRACT -------------------------------------

Trend Micro's Zero Day Initiative has identified a vulnerability affecting the following products: LibreNMS - LibreNMS

-- VULNERABILITY DETAILS ------------------------

Version tested: 25.10.0
Installer file: NA
Platform tested: NA

Analysis

LibreNMS Alert Rule API Stored Cross-Site Scripting

Overview

Alert rules can be created or updated via LibreNMS API. The alert rule name is not properly sanitized, and can be used to inject HTML code.

Affected versions

The latest version at the time of writing (25.10.0) is vulnerable.

Root cause

When an alert rule is created or updated via the API, function add_edit_rule() in includes/html/api_functions.inc.php is called to add/update the entry in the database. When an alert rule is created via the web interface, HTML tags are stripped from the rule name, however this is not the case when using the API.

As such, it is possible to create an alert rule where the name is:

<script>alert(1)</script>

Later, when a victim browses to the Alerts > Alert Rule page, PHP script\xc2\xa0includes/html/print-alert/rules.php\xc2\xa0is called. It notably includes the file\xc2\xa0includes/html/modal/alert_rule_list.inc.php, which returns HTML code for a modal window that searches alert rules.

The modal window includes an HTML table with all rules, including their name, and an inline JavaScript that calls the\xc2\xa0bootgrid()\xc2\xa0function (http://www.jquery-bootgrid.com/) for styling and enhancing the table.

alert_rule.list.inc.php sanitizes the rule name with the function e() before including it in the table, which XML encodes all special characters. However the\xc2\xa0bootgrid()\xc2\xa0function rewrites the table cells content when enhancing the table, and as a side effect, XML character references are decoded. After the script updated the table, the browser now interprets the payload as HTML tags and includes the code to the DOM.

Detection guidance

inspect HTTP POST and PUT requests to a Request-URI that includes the string\xc2\xa0/api/v0/rules
check if the\xc2\xa0name\xc2\xa0JSON value includes a < character

PoC

The proof-of-concept can be run as such:

python3 poc.py ip_addr -T <token>

-- CREDIT --------------------------------------- This vulnerability was discovered by: Simon Humbert of Trend Research of Trend Micro

-- FURTHER DETAILS ------------------------------

Supporting files:

If supporting files were contained with this report they are provided within a password protected ZIP file. The password is the ZDI candidate number in the form: ZDI-CAN-XXXX where XXXX is the ID number.

Please confirm receipt of this report. We expect all vendors to remediate ZDI vulnerabilities within 120 days of the reported date. If you are ready to release a patch at any point leading up to the deadline, please coordinate with us so that we may release our advisory detailing the issue. If the 120-day deadline is reached and no patch has been made available we will release a limited public advisory with our own mitigations, so that the public can protect themselves in the absence of a patch. Please keep us updated regarding the status of this issue and feel free to contact us at any time:

Zero Day Initiative [email protected]

The PGP key used for all ZDI vendor communications is available from:

http://www.zerodayinitiative.com/documents/disclosures-pgp-key.asc

-- INFORMATION ABOUT THE ZDI -------------------- Established by TippingPoint and acquired by Trend Micro, the Zero Day Initiative (ZDI) neither re-sells vulnerability details nor exploit code. Instead, upon notifying the affected product vendor, the ZDI provides its Trend Micro TippingPoint customers with zero day protection through its intrusion prevention technology. Explicit details regarding the specifics of the vulnerability are not exposed to any parties until an official vendor patch is publicly available.

Please contact us for further details or refer to:

http://www.zerodayinitiative.com

-- DISCLOSURE POLICY ----------------------------

Our vulnerability disclosure policy is available online at:

http://www.zerodayinitiative.com/advisories/disclosure_policy/

Affected Packages

1 total 1 fixed

Ecosystem	Package	Vulnerable range	Fix
🐘Packagist	`librenms/librenms`	all versions	25.12.0

Detection & mitigation playbook

Open-source dependency

Detect
Scan your dependency tree (package-lock.json, pnpm-lock.yaml, requirements.txt, go.sum, etc.) for librenms/librenms. O3's reachability analysis confirms whether the vulnerable code path is actually invoked in your application, so you act on real exposure instead of every transitive match.
Fix
Update librenms/librenms to 25.12.0 or later, then make sure no transitive (indirect) dependency still pins the vulnerable range — O3 confirms GHSA-c89f-8g7g-59wj is resolved across your whole dependency graph.
Workarounds
If you can't upgrade right away: gate or disable the affected feature, validate untrusted input at the boundary, and avoid passing attacker-controlled data into the vulnerable path. O3's runtime protection blocks exploitation in production as an interim safeguard until the upgrade lands.
How O3 protects you
O3 pinpoints whether GHSA-c89f-8g7g-59wj is reachable in your code and exactly where to fix it, then blocks exploitation in production at runtime until the patched version is deployed.

Tailored to GHSA-c89f-8g7g-59wj. Runtime protection reduces exposure until a permanent patch is applied and verified — it complements patching, it doesn't replace it.

Frequently Asked Questions

Please find POC file here https://trendmicro-my.sharepoint.com/:u:/p/kholoud_altookhy/IQCfcnOE5ykQSb6Fm-HFI872AZ_zeIJxU-3aDk0jh_eX_NE?e=zkN76d ZDI-CAN-28575: LibreNMS Alert Rule API Cross-Site Scripting Vulnerability -- CVSS ----------------------------------------- 4.3: AV:N/AC:L/PR:H/UI:R/S:U/C:L/I:L/A:L -- ABSTRACT ------------------------------------- Trend Micro's Zero Day Initiative has identified a vulnerability affecting the following products: LibreNMS - LibreNMS -- VULNERABILITY DETAILS ------------------------ * Version tested: 25.10.0 * Installer file: NA * Platform tested:

O3 Security · Impact-Aware SCA

Is GHSA-c89f-8g7g-59wj in your dependencies?

O3 detects GHSA-c89f-8g7g-59wj across Packagist dependencies and uses function-level reachability to confirm whether the vulnerable code path is actually reachable — not just present. No false positives.

Scan my dependencies How O3 SCA works