\";\n\n// proxmox.inc.php:38,42\n$pagetitle[] = $instance; //","image":"https://o3.security/opengraph.png","datePublished":"2026-08-12T15:16:22Z","dateModified":"2026-08-12T15:41:04.197622Z","url":"https://o3.security/vulnerability/CVE-2026-45694","inLanguage":"en","author":{"@id":"https://o3.security/#organization"},"publisher":{"@id":"https://o3.security/#organization"},"mainEntityOfPage":{"@type":"WebPage","@id":"https://o3.security/vulnerability/CVE-2026-45694"},"speakable":{"@type":"SpeakableSpecification","cssSelector":["h1",".vuln-summary",".vuln-severity",".vuln-mitigation"]},"about":[{"@type":"SoftwareApplication","name":"librenms/librenms","applicationCategory":"Packagist","softwareVersion":"26.5.0"}],"citation":[{"@type":"CreativeWork","name":"NVD","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-45694"},{"@type":"CreativeWork","name":"OSV.dev","url":"https://osv.dev/vulnerability/CVE-2026-45694"},{"@type":"CreativeWork","name":"FIRST.org EPSS","url":"https://www.first.org/epss/api-data?cve=CVE-2026-45694"},{"@type":"CreativeWork","url":"https://github.com/librenms/librenms/security/advisories/GHSA-jmqm-f8q4-v7wx"},{"@type":"CreativeWork","url":"https://github.com/librenms/librenms/releases/tag/26.5.0"}]}\";\n\n// proxmox.inc.php:38,42\n$pagetitle[] = $instance; //","url":"https://o3.security/vulnerability/CVE-2026-45694","identifier":"CVE-2026-45694","datePublished":"2026-08-12T15:16:22Z","dateModified":"2026-08-12T15:41:04.197622Z","inLanguage":"en","license":"https://creativecommons.org/licenses/by/4.0/","keywords":["CVE-2026-45694","MEDIUM severity","CWE-79","CVE","vulnerability","security advisory"],"creator":{"@id":"https://o3.security/#organization"},"isAccessibleForFree":true,"citation":[{"@type":"CreativeWork","name":"NVD","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-45694"},{"@type":"CreativeWork","name":"OSV.dev","url":"https://osv.dev/vulnerability/CVE-2026-45694"},{"@type":"CreativeWork","name":"FIRST.org EPSS","url":"https://www.first.org/epss/api-data?cve=CVE-2026-45694"}],"variableMeasured":[{"@type":"PropertyValue","name":"CVSS Base Score","value":5.4,"description":"CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N"},{"@type":"PropertyValue","name":"Severity","value":"MEDIUM"},{"@type":"PropertyValue","name":"EPSS Percentile","value":13}]}\";\n\n// proxmox.inc.php:38,42\n$pagetitle[] = $instance; // GET ?instance=\n$pagetitle[] = $vars['vmid']; // GET ?vmid=\n```\n\n### PoC\n```\nhttp://target/apps?app="}},{"@type":"Question","name":"How severe is GHSA-jmqm-f8q4-v7wx?","acceptedAnswer":{"@type":"Answer","text":"GHSA-jmqm-f8q4-v7wx has a CVSS score of 5.4/10, rated MEDIUM. Review your exposure and patch according to your risk tolerance."}},{"@type":"Question","name":"Which packages are affected by GHSA-jmqm-f8q4-v7wx?","acceptedAnswer":{"@type":"Answer","text":"GHSA-jmqm-f8q4-v7wx affects the following packages: librenms/librenms (Packagist). Ecosystems affected: Packagist."}},{"@type":"Question","name":"How do I fix GHSA-jmqm-f8q4-v7wx?","acceptedAnswer":{"@type":"Answer","text":"Update librenms/librenms to 26.5.0 or later, then make sure no transitive (indirect) dependency still pins the vulnerable range — O3 confirms GHSA-jmqm-f8q4-v7wx is resolved across your whole dependency graph."}},{"@type":"Question","name":"How do I detect GHSA-jmqm-f8q4-v7wx in my Packagist dependencies?","acceptedAnswer":{"@type":"Answer","text":"Scan your dependency tree (package-lock.json, pnpm-lock.yaml, requirements.txt, go.sum, etc.) for librenms/librenms, including transitive dependencies — a direct dependency you never call can still pull in a vulnerable version."}},{"@type":"Question","name":"How do I mitigate GHSA-jmqm-f8q4-v7wx if there is no patch (or I can't update yet)?","acceptedAnswer":{"@type":"Answer","text":"Escape or sanitise the affected output on the server side rather than relying on client-side filtering, and add a Content-Security-Policy that blocks inline script execution so injected markup cannot run even if it reaches the page."}},{"@type":"Question","name":"Is GHSA-jmqm-f8q4-v7wx actively exploited in the wild?","acceptedAnswer":{"@type":"Answer","text":"No public exploit code has been indexed for GHSA-jmqm-f8q4-v7wx yet. This does not mean the vulnerability cannot be exploited — absence of public exploits does not imply safety. Apply the recommended fix and use O3 Security to monitor your exposure."}},{"@type":"Question","name":"What is the EPSS score for GHSA-jmqm-f8q4-v7wx?","acceptedAnswer":{"@type":"Answer","text":"GHSA-jmqm-f8q4-v7wx has an EPSS (Exploit Prediction Scoring System) score of 0.2%, placing it in the 13th percentile of all CVEs. EPSS is maintained by FIRST.org and estimates the probability that a vulnerability will be exploited in the wild within the next 30 days. This score indicates relatively lower exploitation probability, though the CVSS severity should still guide your patching priority."}},{"@type":"Question","name":"What type of vulnerability is GHSA-jmqm-f8q4-v7wx?","acceptedAnswer":{"@type":"Answer","text":"GHSA-jmqm-f8q4-v7wx is classified as Cross-site Scripting (XSS) (CWE-79). This weakness type describe the underlying flaw category, which helps determine the potential impact and the right class of mitigation. This is a high-impact weakness class that often enables remote code execution or data exposure."}},{"@type":"Question","name":"When was GHSA-jmqm-f8q4-v7wx published, and has it been updated?","acceptedAnswer":{"@type":"Answer","text":"GHSA-jmqm-f8q4-v7wx was published on August 12, 2026 and was last updated on August 12, 2026. Advisory data evolves as severity scores, affected ranges, and exploit intelligence are revised — always check the latest version of the advisory before acting."}}]}
Your RSA-2048 keys break in 2030. Find every one of them before attackers do.
🐘
🐘 Packagist
Not in CISA KEV
MEDIUM severity

GHSA-jmqm-f8q4-v7wx — librenms/librenms

MEDIUM

GHSA-jmqm-f8q4-v7wx is a medium-severity (CVSS 5.4) Cross-site Scripting (XSS) vulnerability in librenms/librenms. A fix is available for librenms/librenms — see the affected versions and patch details below.

LibreNMS: Reflected XSS via Proxmox instance/vmid GET parameters injected into document.title JavaScript assignment

Also known asCVE-2026-45694
Published
Aug 12, 2026
Updated
Aug 12, 2026
Affected
1 pkg
Patched
1 / 1
Exploits
None indexed
Exploitation data as of Sep 28, 2026 · OSV.dev, NVD, FIRST.org (EPSS)

Exploitation Status

No confirmed exploitation observed yet

  • CISA’s own triage has not observed active exploitation or public proof-of-concept code for this CVE as of its last assessment.

Exploitation and automatability from CISA’s SSVC triage for GHSA-jmqm-f8q4-v7wx.

EPSS Exploitation Probability

via FIRST.org ↗
0.2%probability of exploitation in next 30 days
Lower Risk0.00%
Lower risk than most CVEs13th percentile — riskier than 13% of all scored CVEsHighest risk

Probability of exploitation in the next 30 days, from FIRST.org EPSS.

How urgent is this, really

GHSA-jmqm-f8q4-v7wx by exploitation likelihood (EPSS) against impact (CVSS). Outside the shaded patch-first corner.

Where this sits among everything scored

Of 380,066 CVEs with a current EPSS score, this one falls in the < 10% band (highlighted). Counts from FIRST.org, log-scaled.

Real-World Exposure

1 pkg affected
🐘librenms/librenms

Real-time download stats are indexed for npm and PyPI packages. This vulnerability affects Packagist packages — download data is not available via public APIs for these ecosystems.

Description

Summary

LegacyController.php:75 writes the page title into a document.title JS assignment using string interpolation. apps/proxmox.inc.php pushes $vars['instance'] and $vars['vmid'] (GET params, only strip_tags() applied) directly into $pagetitle. A single quote terminates the JS string, executing arbitrary script.

Details

// LegacyController.php:75
$html .= "<script>\ndocument.title = '$title';\n</script>";

// proxmox.inc.php:38,42
$pagetitle[] = $instance;     // GET ?instance=
$pagetitle[] = $vars['vmid']; // GET ?vmid=

PoC

http://target/apps?app=proxmox&instance=%27%3Balert%28document.cookie%29%3B//

Confirmed in response:
document.title = 'Apps - Proxmox - ';alert(document.cookie);// - LibreNMS';

Fix

// LegacyController.php:75
$html .= "<script>\ndocument.title = " . json_encode($title) . ";\n</script>";

Also wrap $instance and $vars['vmid'] in htmlspecialchars() in proxmox.inc.php.

Prerequisite

Any authenticated session. Victim must follow a crafted link.

Affected Packages

1 total 1 fixed
EcosystemPackageVulnerable rangeFix
🐘Packagistlibrenms/librenmsall versions26.5.0composer require librenms/librenms:^26.5.0

Detection & mitigation playbook

Open-source dependency

  1. Detect

    Scan your dependency tree (package-lock.json, pnpm-lock.yaml, requirements.txt, go.sum, etc.) for librenms/librenms, including transitive dependencies — a direct dependency you never call can still pull in a vulnerable version.

  2. Fix

    Update librenms/librenms to 26.5.0 or later, then make sure no transitive (indirect) dependency still pins the vulnerable range — O3 confirms GHSA-jmqm-f8q4-v7wx is resolved across your whole dependency graph.

  3. Workarounds

    Escape or sanitise the affected output on the server side rather than relying on client-side filtering, and add a Content-Security-Policy that blocks inline script execution so injected markup cannot run even if it reaches the page.

Frequently Asked Questions

### Summary `LegacyController.php:75` writes the page title into a `document.title` JS assignment using string interpolation. `apps/proxmox.inc.php` pushes `$vars['instance']` and `$vars['vmid']` (GET params, only `strip_tags()` applied) directly into `$pagetitle`. A single quote terminates the JS string, executing arbitrary script. ### Details ```php // LegacyController.php:75 $html .= "<script>\ndocument.title = '$title';\n</script>"; // proxmox.inc.php:38,42 $pagetitle[] = $instance; // GET ?instance= $pagetitle[] = $vars['vmid']; // GET ?vmid= ``` ### PoC ``` http://target/apps?app=
O3 Security · Impact-Aware SCA

Is GHSA-jmqm-f8q4-v7wx in your dependencies?

Find it across Packagist, including transitive dependencies.

Scan my dependencies How O3 SCA works
GHSA-jmqm-f8q4-v7wx: librenms/librenms | O3 Security